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FOREWORD 


This document presents the results of a contract study performed for the 
National Aeronautics and Space Administration (NASA) by the Douglas Aircraft 
Company, McDonnell Douglas Corporation. This work was part of the Energy 
Efficient Transport (EET) project of the Aircraft Energy Efficiency (ACEE) 
program. Specifically, the study was one task in the contract — Selected 
Advanced Aerodynamic and Active Control Concepts Development. The reported 
study includes the formulation and evaluation of control laws and system 
architectures with respect to reliability, flying qualities, and aircraft 
flightpath tracking performance. 
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SECTION 1 

INTRODUCTION, SUMMARY, AND CONCLUSIONS 


Introduction 

It has long been recognized that penalties in weight and trim drag, along 
with the resultant increase in energy usage, are incurred by utilizing the 
conventional solution to provide adequate longitudinal stability in aircraft. 
These penalties could be reduced somewhat by incorporating artificial stability 
through an active control system. However, it is difficult to determine the 
best combination of aircraft configuration and control system design because 
the process involves an interrelationship of flying qualities, reliability 
and safety, and the design and development of the control system. The design 
must be governed also by certification and cost factors. 

Anticipating that a significant gain could be realized in the next generation 
of aircraft, it was proposed to consolidate into one study the principal 
considerations that would guide the selection of an acceptable standard. It 
would seem logical that the flight integrity of the next generation of 
aircraft would not be allowed to depend completely upon the augmentation 
system. Accordingly, in the event of any failure of the system, the aircraft 
should be so configured as to permit the pilot to fly and land safely. In 
this sense, the augmentation system is described as having "low risk." 

The aircraft configuration chosen as the basis for this study is representative 
of a family of commercial transports which, being the largest, is therefore 
the greatest user of fuel. The aircraft is the Douglas DC-X-200 - a major 
derivative of the DC-10 - designed for a nominal seat capacity of 230, with 
a design range of 5844 km (2620 n mi); the study evaluation mission, typical 
of a large class of operations, has a block distance of 1389 km (750 n mi). 

The aircraft has a shortened DC-10 fuselage, with twin engines mounted 
conventionally under a high-aspect-ratio wing with supercritical sections. An 
advanced high-lift system is included, consisting of a full-span variable 
Krueger leading-edge flap and an 80-percent-span, high-extension, two-segment 
flap. Because preliminary design studies for this aircraft revealed a benefit 
for relaxed static stability, the configuration was arranged with a design 
minimum aerodynamic center margin of zero. This baseline aircraft is sub- 
sequently referred to as the Energy-Efficient Transport (EET). 
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The objective of this study is the development of the system required to 
augment the aircraft's relaxed static stability. This system is referred to 
as the RSSAS (relaxed static stability augmentation system). The study com- 
prises three distinct elements. The first element includes the definition of 
the design constraints related to the aircraft flying qualities and reliability/ 
safety criteria. Flying qualities criteria were established and verified 
primarily with an evaluation of the unaugmented EET on a six-degree-of- 
freedom motion-base simulator. System reliability requirements are based on 
the existing capabilities of the DC-10. The safety criterion is an interpre- 
tation of the various commercial transport regulatory requirements. The second 
study element is the system design. From control law synthesis and verification, 
the RSSAS was architecturally constructed and analyzed at the individual 
component and system level. In the third element of the study, selected 
systems were established for evaluation. Using the motion-base simulator, the 
flying qualities of the augmented aircraft were demonstrated. Quantitative 
system performance was analyzed and compliance with the established reliability 
and safety criteria was shown. Finally, the anticipated impact of relaxed 
static stability on certification of the aircraft was determined. 

Summary and Conclusions 

An aircraft parametric study which analyzed the effect of decreasing levels of 
stability provided a prime motivation for the development of an RSSAS for the 
EET. In this study, the same basic aircraft configuration was sized for 
three different center-of-gravity operating ranges, with the aerodynamic 
center margin at the aft limit in these cases being +10, 0, and -14.3 percent 
of MAC (mean aerodynamic chord). The positive case represents current 
practice. Fuel usage was then determined for a fixed, average mission length 
of 750 nautical miles, assuming realistic profiles and loading conditions. As 
the stability went from the conventional level to neutral, a 2-percent fuel 
savings was projected. For longer missions, the savings would be greater. 

The actual stability level to be recommended was developed from the RSSAS 
flying-qualities evaluation. 

The first phase of the flying-qualities evaluation was conducted using the 
unaugmented aircraft on the Douglas six-degree-of-freedom motion-base 
simulator. Various center-of-gravity locations, flight conditions, aircraft 
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configuration changes, and environmental conditions were demonstrated. The 
results of the solicited pilot ratings established a relationship of flying 
qualities -- in terms of Cooper-Harper ratings -- to aircraft static margin 
for the approach condition, and to maneuver margin for the cruise case. 

These parameters were chosen because of their strong association with center- 
of-gravity location and relaxed stability. These margins were converted to 
aerodynamic center margin for determination of fuel savings. To achieve the 
maximum acceptable mean pilot rating of 6.5, the corresponding aerodynamic 
center margin was determined to be: 

• In the approach phase, an aerodynamic center margin more than -3.1 percent 
MAC. 

• In the nonterminal phase, an aerodynamic center margin more than -4.5 
percent MAC. 

It was determined, by virtue of the critical tail-sizing requirements, that 
the nonterminal phase was critical, thus establishing a potential fuel savings 
for the evaluation mission of 2.8 percent. 

The pilot rating results reflect an interpretation of the pilot opinions that 
weigh the results to the worst mean ratings in the array of tests. This 
interpretation recognizes that the worst means are probably representative of a 
significant proportion of the pilot population and that a safety-related 
requirement should take this factor into consideration. The severity of the 
interpretation has a significant effect on the allowable stability margin. It 
is concluded that future studies in this area should carefully evaluate pilot 
ratings in the stability area of interest. 

Using existing Douglas modern control analysis and simulation programs, 
augmentation control laws were developed, employing an implicit-model- 
fol lowing technique with the conventionally stable DC-10 aircraft as the 
flying-qualities model. The neutrally stable EET 40 percent MAC center-of- 
gravity configuration was augmented with several different control laws 
using various combinations of aircraft dynamic feedbacks representing 
existing DC-10 sensor arrays. The static margin of the EET configuration 
was approximately zero while the static margin of the DC-10 model was about 
20 percent MAC. With these multiple control laws, it was shown that: 
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• Performance of the DC-10 "model" was duplicated by the augmented EET. 

• Control law redundancy provided a technique to increase the system 
functional availability. 

A flying-qualities evaluation of three of these control laws (eeua,eea,a) was 
performed on the motion-base simulator. The pilot ratings achieved with the 
augmented EET showed a significant flying-qualities improvement, with the 
augmented 40-percent MAC center-of-gravity, neutrally stable aircraft dupli- 
cating approximately the ratings of the unaugmented 25-percent MAC center-of- 
gravity EET. The augmentation system was additionally evaluated for a 
negative statically stable center-of-gravity location, compensation of the 
pitching moment characteristics resulting from thrust changes, and failure- 
reversion configurations. It was successfully demonstrated that: 

. • The proposed control laws provided equally satisfactory augmentation for 
neutral (design point) and negative static stability, and 

• Thrust pitching moments were adequately controlled for all flight 
maneuvers. 

The total RSSAS functional design was accomplished, including definition of 
the major system elements: the sensors, computers, actuation, and interfaces. 

Then, based upon the Douglas interpretation of the regulatory reliability and 
safety requirements, plus the Douglas requirements, candidate architectures 
were formulated and evaluated. Two augmentation system configurations were 
selected which differ only in the computer redundancy. One has two computers; 
the other has three computers. Both use existing aircraft sensors (three 
vertical gyros, two air-data computers, and two angle-of-attack transducers), 
and both achieve control through the two inboard elevator actuators which are 
modified to accept dual-series augmentation commands. The computers are 
either dual- or triple-redundant, depending upon the dispatch-inoperable 
capability desired. 

A complete reliability analysis was performed on the selected systems. The • 
functional reliability was calculated for the normal system configurations 
and for the worst-case dispatch-inoperable configurations. Significantly, 
compliance with the regulatory requirements was verified for both the dual- 
and triple-redundant system configurations. For the system requirements that 
the EET RSSAS must meet, compliance was interpreted to mandate a probability 
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of function loss of less than 1 x 10 -5 per flight hour. Also, the total EET 
flight control system with the RSSAS was found to equal the established 
reliability standard of the DC- 10 flight control system. 

Finally, to provide some insight as to the impact of incorporating an RSSAS 
into a commercial transport, the pertinent FAA regulations were listed, a 
validation plan proposed, and a typical airframe manufacturer's cost (including 
RSSAS hardware) estimated. 
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SECTION 2 

AIRCRAFT CONFIGURATION, CRITERIA, FLYING QUALITIES, AND EVALUATION 


2.1 Stability and Control Considerations 

Relaxed static stability offers some of the more significant benefits 
that may be derived from active control technology. For a transport aircraft, 
the primary benefit is reduced aircraft drag and weight for a given payload 
and mission, arising from a reduction in tail volume. 

Relaxed static stability is accomplished through a more aft center-of- 
gravity location and/or a smaller horizontal tail size. The reduced stability 
results from the decreased aerodynamic restoring-moment with respect to 
angle of attack. This alteration of static stability naturally has a sub- 
stantial impact on the aircraft longitudinal dynamics, affecting both the 
short-period and phugoid modes. As the inherent stability is reduced, flying 
qualities tend to degrade. Therefore the deficiencies, both in static and 
dynamic stability, must be compensated for by a relaxed static stability 
augmentation system (RSSAS). While, for the next generation of commercial 
transports, it might be possible to devise an RSSAS reliable enough to. 
maintain the flight integrity of an inherently unstable aircraft, such a system 
was not considered in the present study. The aircraft that was considered 
would allow the pilot to fly and land safely if the system failed. The 
study did, in fact, conclude that a negatively stable aircraft could provide 
these qualities. 

Basic design considerations influencing wing location, center-of- 
gravity range and limits, and horizontal tail size are affected by the 
requirements of both augmented and unaugmented modes of flight. The 
considerations germane to this study are discussed below. 

Tail area requirements for the forward center-of-gravity limit 
typically have been set by trim capability or by the degree of control 
required to develop maximum lift in the landing configuration. The 
critical condition depends on the type of control system selected, i.e., 
separate trim and control surfaces, or a single surface providing both 
control and trim. Aft center-of-gravity limit requirements have generally 
been set by minimum levels of static longitudinal stability. For the 
active-control relaxed stability design, the horizontal tail area may be set 
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by one or more of the following: the landing case, the pitching moment 

required for takeoff rotation at forward center-of-gravity locations, the 
reduced level of stability, the pitching acceleration required for control 
in the presence of gusts, or high angles of attack at aft center-of-gravity 
locations. These points are illustrated in Figure 2-1, which shows the typical 
active-controlled aircraft rebalanced with a farther-aft center-of-gravity 
range and a smaller horizontal tail. The dashed lines in the figure show 
requirements not yet critical for the reduced tail size. Further reduction 
and a more aft rebalancing may emphasize these requirements. Other 
requirements may also become critical. An example from the nonflight mode, 
where aerodynamic controls become ineffective, is the requirement for 
ground stability and control. This condition determines criteria for nose- 
wheel steering and for tipback stability, and in turn leads to requirements 
determining location of the main landing gear. The landing gear location 
is closely interrelated with the aerodynamic and structural design of the 
wing, unless the penalties associated with a fuselage-mounted gear are 
accepted. 

The typical variation of airplane drag with center-of-gravity position is 
illustrated in Figure 2-2. This variation results from an interchange between 
the tail-induced drag, the drag component of the tail lift vector, and the wing- 
induced/compressibility drag characteristics (i.e., the basic .components of the 
trim drag formulation). As the center of gravity is moved aft, the tail load 
required to trim (download) is reduced until it finally reaches zero and then 
becomes an upload. The trim drag is not necessarily a minimum at the point 
where the tail load goes to zero, since an upload on the tail will help the 
wing-induced/compressibility drag, thus continuing to reduce the trim drag 
until the tail contribution begins to dominate. The exact center-of-gravity 
location for minimum trim drag is largely dependent upon the aircraft 
configuration. 

Three areas of interest must be examined to determine the acceptable 
longitudinal stability characteristics of the unaugmented aircraft. The 
first is where the stability is measured by "static margin." Static margin 
relates the neutral point to the center of gravity. The neutral point is 
the center-of-gravity location at which the static stability is neutral and 
the elevator deflection per knot of speed is zero. All three longitudinal 
degrees of freedom — speed, attitude, and angle of attack - are involved. 
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This form of stability is of importance in determining pilot opinion of 
flying qualities. The second area of interest is the "aerodynamic center." 

The aerodynamic center is the point about which pitching moments are 
invariant with angle of attack. It is not the same as the neutral point. 

No other degrees of freedom are involved; it is a single degree-of-freedom 
parameter. There is no commonly accepted term describing the distance 
between the center of gravity and the aerodynamic center, but in this 
report, the term "aerodynamic center margin" will be used. Similarly, the 
term "aerodynamic center stability" will be used when referring to this 
type of stability. It is this area of stability which is of importance in 
determining fuel savings due to the relaxed-static stability concept. The 
third type of stability of interest in this study is "maneuvering stability," 
measured by elevator angle per load factor. Like aerodynamic center stability, 
maneuvering stability is determined at constant speed. The difference 
between the two arises from pitch damping effects, which cause the maneuver 
point to fall aft of the aerodynamic center. This type of stability is of 
particular interest for flight conditions in which load factor changes 
provide important cues to the pilot. 

2.2 Aircraft Configuation Studies and Baseline Definition 

2.2.1 Initial Investigations. - The explorations giving rise to the 
aircraft baseline for this study centered on a major derivative of the DC-10. 
The guideline for this derivative defined a nominal seat capacity of 230, 
with a design range of 5844 km (2620 n.mi.). The range capacity encompasses 
a fleet class which has the largest number of commercial transports. This 
class is therefore the greatest user of fuel. 

The aircraft mission design requirements are shown in Table 2-1. For 
the class of aircraft described, the most representative operation has a 
block distance of 1389 km (750 n.mi.), and this was chosen for the study 
evaluation. The mission rules are defined in Table 2-2. 

The aircraft family which resulted from the guidelines and requirements 
was generically known as the DC-X-200, subsequently referred to in this report 
as the Energy Efficient Transport (EET). The family is characterized by a 
shortened DC-10 fuselage, and twin engines mounted conventionally under a 
high-aspect-ratio wing with supercritical sections. 
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TABLE 2-1 

AIRCRAFT MISSION REQUIREMENTS 


Payload 

Range 

Initial Cruise Altitude 
Initial Cruise Mach No. 
Approach Speed 


21,390 kilograms (47,150 pounds) 

(230 passengers and baggage) 

5844 kilometers (2620 nautical miles) 
equivalent still air distance 

10,363 meters (34,000 feet) 

0.80 

76 m/s (148 knots) 


TABLE 2-2 

EVALUATION MISSION PROFILE 


Flight Segment 
Taxi Out 
Takeoff 
Cl imb 

Cruise 


Descent 
Approach 
Taxi in 


Requirements 

5 minutes at taxi thrust 

Climb to 457 meters (1500 feet) 

Maximum climb thrust, long-range climb schedule 
to initial cruise altitude 

Constant Mach number, step cruise technique 
(31,000, 35,000, 39,000 feet) 

1389- kilometer (750-nautical-mile) mission 
at best constant odd altitude 

Employ long-range speed schedule to sea level 

4 minutes at approach thrust 

3 minutes at taxi thrust 


Reserve fuel based on FAR 121.639 as follows: 

Climb from sea level to 9144 meters (30,000 feet) using maximum-climb 
thrust and long-range speed schedule, cruise at 9144 meters (30,000 
feet) at 99-percent maximum specific range, descent to sea level for 
total distance to alternate of 370.4 kilometers (200 nautical miles), 
and cruise for 45 minutes at 9144 meters (30,000 feet) at 99-percent 
maximum specific range. 
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Prior to the definition of the EET baseline aircraft, a parametric 
study was conducted to assess the configuration characteristics of EET 
family aircraft as a function of aerodynamic center margin. Three aircraft 
of this family were sized and configured to reflect an aerodynamic center 
margin at aft center of gravity of 10 percent, 0 percent, and -14.3 percent. 

The 10 percent margin aircraft represented an aircraft of currently 
conventional levels of natural longitudinal stability, for example, the DC-10. 
The 0 percent margin aircraft, having neutral stability at the aft limit, 
represented a class which the current pace of technology development might 
make acceptable for the next generation. The -14.3 percent margin aircraft 
represented an aircraft with natural instability, the margin value being an 
arbitrary product of other design requirements. Each parametric design was 
checked for realistic design conditions and layout. Payload arrangement 
and fuel usage effects on the flight center of gravity were included in the 
definition of the mission aircraft. 

The characteristics of the three configurations are shown in Table 2-3, 
together with the block fuel required for the evaluation mission defined in 
Table 2-1. 

The fuel savings due to relaxed static stability relative to the 
inherently stable aircraft have been plotted as a function of aerodynamic 
center margin in Figure 2-3. The neutrally stable aircraft would save 
2 percent of fuel. The inherently unstable aircraft would save just over 
4 percent. For missions longer than the evaluation mission, the fuel savings 
would be greater. 

The data shown in Figure 2-3 indicate that further fuel savings will 
accrue with an even more unstable configuration. In order to pursue such 
savings, a number of design conditions would have to be altered, and a new 
family of configurations would emerge. For example, as explained in 
Paragraph 2.1, difficulties are apparent with the more unstable aircraft in 
the installation of a wing-mounted landing gear. A different wing having a 
thicker airfoil with more conventional sections might be justified to house 
the required gear. A lower design cruise Mach number, allowing a wing with 
less sweep or more thickness, might also help if market requirements permitted. 
No such changes were considered in this report. 


A . 

1 y 
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TABLE 2-3 

COMPARISON OF PARAMETRIC CONFIGURATIONS 


AERODYNAMIC CENTER MARGIN 
AT AFT CG LIMIT 

+10 PERCENT 

+0 PERCENT 

-14.3 PERCENT 

ENGINE SLST RATING KN (LB) 

209.73 

(45,950) 

200.17 

(45,000) 

195.68 

(43,990) 

PASSENGERS 


230 


230 


230 

PAYLOAD, KG (LB) 

21,387 

(47,150) 

21,387 

(47,150) 

21,387 

(47,150) 

RANGE, KM (N Ml) 

4,854 

(2,621) 

4,854 

(2,621) 

4,854 

(2,621) 

CRUISE MACH 


0.80 


0.80 


0.80 

ASPECT RATIO 


10.85 


10.85 


10.85 

TRAPEZOIDAL WING AREA M 2 (SQ FT) 

213.2 

(2,295) 

208.1 

(2,240) 

201.1 

(2,165) 

HORIZONTAL TAIL AREA M Z (SQ FT) 

75.5 

(813) 

63.5 

(684) 

49.0 

(527) 

MAX TAKEOFF WEIGHT KG (LB) 

135,669 

(299,100) 

133,809 

(295,000) 

131,768 

(290,500) 

OPERATING EMPTY WEIGHT KG (LB) 

80,256 

(176,930) 

79,239 

(174,690) 

77,997 

(171,950) 

BLOCK FUEL FOR 1,389 KM (750 N Ml) 
MISSION, KG (LB) 

8,447 

(18,623) 

8,276 

(18,245) 

8,096 

(17,849) 


BLOCK FUEL 

SAVINGS 

(PERCENT) 



AERODYNAMIC CENTER MARGIN 
(PERCENT MAC) 


FIGURE 2-3. FUEL SAVINGS FROM PARAMETRIC STUDY 
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After consideration of the initial studies, it was determined that the 
EET baseline should be configured with zero aerodynamic center margin until 
any recommendation to the contrary could be made. 

2.2.2 Baseline Definition. - The EET baseline aircraft is shown in 
Figure 2-4, with its principal geometry summarized in the tabular inset of 
the figure. The aircraft conformed to the family characteristics previously 
described, but is the product of further study and refinement. The wing 
includes an advanced high lift system consisting of a full-span variable 
Krueger leading edge flap and an 80 percent span, high-extension, two-segment 
trail ing-edge flap. 


2.3 Development of Aerodynamic Data 

Aerodynamic data for the study were developed in two phases. In the 
first phase, data were generated and put in the form of linear small - 
perturbation equations of motion for application to control system design. 

In the second phase, more complete large-flight-envelope (LFE) characteristics 
were developed for use in programming the motion-base simulator. The LFE 
data were presented as functions of such parameters as Mach number, altitude, 
and angle of attack. The methods used for both forms of estimation were 
normal for preliminary design, e.g., DATCOM procedures and references to 
DC-10, limited DC-X-200 wind tunnel data, and other empirical data. A 
comparison was made of the LFE with the equations of motion previously written 
and only negligible differences were noted. The LFE data were then programmed 
on the motion-base simulator host computer. Concurrently, a second set of 
equations of motion were developed for the control system design effort 
using the LFE data in a linearized form. 

The aircraft mass used for the bulk of the study was 115,666 kg 
(255,000 lb). This is representative of high weights in cruise. As a 
result of past experience and judgment, two flight conditions were selected 
for use in the design effort: a low-speed (72 m/s (140-kn) landing approach 

case, and a cruise flight case. It may be noted that the approach and cruise 
flight phases were subsequently judged to be of critical interest in the 
piloted simulations (see Paragraph 3.1). A description of the design cases 
is tabulated below: 
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Landing 


Cruise 


V e = 72 m/s (140 kn) M = 0.8 


Sea Level 


h 

= 10,668 m (35,000 ft) 

Center-of-Gravi ty 
Location 

= 40 percent MAC 

Center-of-Gravity 

Location 

= 40 percent MAC 

“nsp 

= 0.509 rad/s 

a>n S p 

= 0.967 rad/s 

? SP 

= 0.969 

? SP 

= 0.533 

w n PH 

= 0.051 rad/s 

“"PH 

= 0.226 rad/s 

C PH 

= -0.092 

C PH 

= 0.250 

n/ct 

=3.79 g/rad 

n/a 

= 11.82 g/rad 

dy/dV 

= 0.0088 rad/m/s 
(0.260 deg/kn) 

dy/dV 

= 0.0020 rad/m/ s 
(0.059 deg/kn) 


Data for other conditions were generated for use in the flying qualities 
analysis and for motion-base simulation. Fifteen combinations of five center- 
of-gravity locations (25-, 35-, 40- , 45-, and 50-percent MAC) and three 
horizontal tail sizes (100, 85, and 70 percent of basic) were selected. The 
100 percent of basic tail area size corresponds to the baseline configuration. 

While both center-of-gravity location and horizontal tail size have a 
direct effect on the static stability of the aircraft, variations in tail size 
were included in the test matrix with the idea of identifying problems that 
might be attributed to deficient pitch control at different stability levels. 
However, tail size has a significant effect also on pitch damping, thereby 
complicating the task of identifying potential control problems. 

Linearized equations of motion were developed from the LFE data for the 
combinations of center-of-gravity and tail-size cases at the cruise flight 
condition and a normal landing approach condition [V e = 76 m/s (148 kn)]. The 
effect of center-of-gravity location and tail size on aircraft stability for 
the landing approach case is shown in Figure 2-5a. A similar presentation 
for the cruise condition is given in Figure 2-5b, except that maneuver margin 
is used for the stability metric. A tabulation of the flying qualities 
characteristics of these 30 cases is presented in Tables 2-4 and 2-5. Root 
locus diagrams for variations of center-of-gravity location are presented for 
the three tail sizes in Figures 2-6, 2-7, and 2-8 for the landing approach 
condition. Similar presentations are made in Figures 2-9, 2-10, and 2-11 for 
the cruise condition. 
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TABLE 2-4 

SUMMARY OF FLYING QUALITIES CHARACTERISTICS IN LANDING APPROACH 

- UNAUGMENTED AIRCRAFT - 


CENTER-OF-GRAVITY 

LOCATION 

TAIL 

AREA 

“n S p 

Hp 

“npH 

q PH 

T 2 

STATIC 

MARGIN 

n/a 

dy/dV 

{% MAC) 

(% OF BASIC) 

(RAD/S) 


(RAD/S) 


(SEC) 

(% MAC) 

(g/RAD) 

(DEG/KN) 

25 

100 

0.849 

0.641 

0.146 

-0.028 

— 

15.8 

4.02 

0.178 

35 

100 

0.657 

0.813 

0.114 

-0.065 

— 

5.8 

4.11 

0.174 

40 

100 

0.524 

0.992 

0.051 

-0.007 

— 

0.8 

4.16 

0.172 

45 

100 

— 

— 

0.191 

0.695 

5.41 

-4.2 

4.21 

0.170 

50 

100 

_ 

— 

0.202 

0.460 

3.25 

-9.2 

4.25 

0.168 

25 

85 

0.722 

0.705 

0.137 

-0.052 

— 

10.2 

4.02 

0.178 

35 

85 

— 

— 

0.030 

0.090 

— 

0.2 

4.11 

0.174 

40 

85 

— 

— 

0.189 

0.603 

4.77 

-4.8 

4.16 

0.172 

45 

85 

— 

— 

0.198 

0.407 

2.96 

-9.8 

4.21 

0.170 

50 

85 

— 

— 

0.198 

0.311 

2.17 

-14.8 

4.25 

0.168 

25 

70 

0.568 

0.833 

0.114 

-0.085 

— 

4.6 

4.02 

0.178 

35 

70 

— 

— 

0.187 

0.510 

4.12 

-5.4 

4.11 

0.174 

40 

70 

— 

— 

0.193 

0.355 

2.65 

-10.4 

4.16 

0.172 

45 

70 

— 

— 

0.193 

0.277 

1.99 

-15.4 

4.21 

0.170 

50 

70 

— 

— 

0.192 

0.231 

1.60 

-20.4 

4.25 

0.168 



TABLE 2-5 

SUMMARY OF FLYING QUALITIES CHARACTERISTICS IN CRUISE FLIGHT 
- UNAUGMENTED AIRCRAFT - 


CENTER-OF-GRAVITY 

LOCATION 

TAIL 

AREA 

“nsp 

Hp 

“npH 

? PH 

MANEUVER 

MARGIN 

AERO 

CENTER 

n/a 

(% MAC) 

{% OF BASIC) 

(RAD/S) 


(RAD/S) 


(% MAC) 

(% MAC) 

(g/RAD) 

25 

100 

1.509 

0.377 

0.156 

0.192 

27.8 

49.3 

10.91 

35 

100 

1.181 

0.455 

0.190 

0.229 

17.8 

49.3 

11.14 

40 

100 

0.967 

0.533 

0.226 

0.250 

12.8 

49.3 

11.27 

45 

100 

0.676 

0.741 

0.315 

0.199 

7.8 

49.3 

11.40 

50 

100 

— 

— 

0.392 

-0.175 

2.8 

49.3 

11.52 

25 

85 

1.303 

0.397 

0.160 

0.191 

21.3 

43.3 

10.90 

35 

85 

0.899 

0.536 

0.218 

0.232 

11.3 

43.3 

11.14 

40 

85 

0.600 

0.807 

0.316 

0.128 

6.3 

43.3 

11.27 

45 

85 

— 

— 

0.374 

-0.276 

1.3 

43.3 

11.39 

50 

85 

— 

— 

0.384 

-0.579 

-3.7 

43.3 

11.52 

25 

70 

1.055 

0.441 

0.168 

0.189 

14.5 

36.8 

10.90 

35 

70 

0.526 

0.909 

0.310 

0.017 

4.5 

36.8 

11.14 

40 

70 

— 

— 

0.348 

-0.404 

-0.5 

36.8 

11.27 

45 

70 

— 

— 

0.353 

-0.718 

-5.5 

36.8 

11.39 

50 

70 

— 

— 

0.351 

-0.989 

-10.5 

36.8 

11.53 



CG LOCATIONS NOTED 



FIGURE 2-6. LOCUS OF ROOTS AS CG IS MOVED AFT, IN LANDING APPROACH - BASIC 
TAIL AREA 


CG LOCATIONS NOTED 



a { RAD/S) 

FIGURE 2-7. LOCUS OF ROOTS AS CG IS MOVED AFT, IN LANDING 
APPROACH - 85 PERCENT OF BASIC TAIL AREA 
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FIGURE 2-11. LOCUS OF ROOTS AS CG IS MOVED AFT. IN CRUISE 
FLIGHT - 70 PERCENT OF BASIC TAIL AREA 
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2.4 Flying Qualities Criteria 

In this study, flying qualities criteria were required for two purposes. 
First, there was the need to specify the flying qualities that would be 
acceptable in the event of total augmentation system failure, i.e., flying 
qualities of the unaugmented vehicle in the most critical condition. The 
second purpose was to establish the flying qualities desired with the 
augmentation system in normal operation. 

In the first case, acceptable unaugmented aircraft flying qualities were 
determined on the basis of safety considerations. It is usual for flying 
qualities to be described in terms of either Cooper-Harper pilot rating 
values (Figure 2-12 and Reference 1) and/or the military flying qualities 
"Levels" (Reference 2). Safety considerations for commercial transport 
aircraft dictate a maximum acceptable pilot rating of 6.5, which corresponds 
approximately to the boundary for Level 2 from the military specification. In 
the second case, the desired flying qualities of the normal augmented aircraft 
are those of military Level 1, which corresponds to a pilot rating of 3.5 or 
better. 

At the outset of the program it was decided that satisfactory (Level 1) 
flying qualities for the augmented vehicle could be ensured by requiring the 
augmentation system to provide a match with the proven good flying qualities 
of the DC-10 in terms of phugoid-mode time histories and short-period 
characteristics measured by the "Bandwidth Model." In addition, other 
criteria were considered for application to this task to furnish confidence 
in the final characteristics. The "Bandwidth Model" is a pitch-tracking 
criterion originally developed by Calspan (Reference 3) which has been modified 
and adopted by Douglas for use in transport design work. The Douglas work is 
reported in Reference 4, and briefly described in Appendix 1, and the criterion 
is depicted in Figure 2-13. The criterion considers the amount of compensation, 
lead or lag, that the pilot must apply to achieve a given level of pitch- 
tracking performance without encountering pilot-induced-oscillation tendencies. 
The types of aircraft response expected from pilot commands are noted in 
each section of the chart. While this criterion may be used for both landing 
approach and cruise flight conditions, there is less confidence when it is 
applied to cruise cases, particularly in the left side of the diagram. In 
developing the criterion, there were relatively few data available to construct 
the boundaries in this area. 
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CLOSED LOOP, RESONANCE |0/0 | (dB) 


DEMANDS ON THE PILOT IN SELECTED PILOT 
AIRCRAFT CHARACTERISTICS TASK OR REQUIRED OPERATION* RATINGS 


EXCELLENT - 
HIGHLY DESIRABLE 


GOOD - 

NEGLIGIBLE DEFICIENCIES 

FAIR - SOME MILDLY 
UNPLEASANT DEFICIENCIES 


PILOT COMPENSATION NOT A FACTOR 
FOR DESIRED PERFORMANCE 


PILOT COMPENSATION NOT A FACTOR 
FOR DESIRED PERFORMANCE 

MININAL PILOT COMPENSATION 
REQUIRED FOR DESIRED 
PERFORMANCE 


^ IS IT \ 

SATISFACTORY WITHOUT 
IMPROVEMENT? 


, DEFICIENCIES 
WARRANT 
, IMPROVEMENT 


MINOR BUT ANNOYING 
DEFICIENCIES 

MODERATELY OBJECTION- 
ABLE DEFICIENCIES 

VERY OBJECTIONABLE BUT 
TOLERABLE DEFICIENCIES 


DESIRED PERFORMANCE REQUIRES 
MODERATE PILOT COMPENSATION 


ADEQUATE PERFORMANCE REQUIRES 
CONSIDERABLE PILOT COMPENSATION 


ADEQUATE PERFORMANCE REQUIRES 
EXTENSIVE PILOT COMPENSATION 


IS ADEQUATE 

PERFORMANCE \ NO DEFICIENCIES 

Attainable with a tolerabl^— ^ require 

PILOT WORKLOAD? IMPROVEMENT 


MAJOR DEFICIENCIES 


MAJOR DEFICIENCIES 


MAJOR DEFICIENCIES 


ADEQUATE PERFORMANCE NOT 
ATTAINABLE WITH MAXIMUM 
TOLERABLE PILOT COMPENSATION. 
CONTROLLABILITY NOT IN QUESTION 

CONSIDERABLE PILOT COMPENSATION 
IS REQUIRED FOR CONTROL 

INTENSE PILOT COMPENSATION IS 
REQUIRED TO RETAIN CONTROL 


IT CONTROLLABLE? 


PILOT DECISIONS l 


IMPROVEMENT 

MANDATORY 


MAJOR DEFICIENCIES 


CONTROL WILL BE LOST DURING SOME! 
PORTION OF REQUIRED OPERATION | 


♦DEFINITION OF REQUIRED OPERATION INVOLVES DESIGNATION OF FLIGHT PHASE 
AND/OR SUBPHASES WITH ACCOMPANYING CONDITIONS 


FIGURE 2-12. HANDLING QUALITIES RATING SCALE 


ABRUPT RESPONSE 
STRONG PIO 
TENDENCIES 
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A criterion often mentioned for application to unstable aircraft in- 
volves the time-to-double-amplitude of the most unstable first-order root 
of the longitudinal characteristic equation. For example. Reference 5, which 
reported an inflight simulation of a supersonic transport configuration, 
cites a minimum acceptable time-to-double-amplitude of 2.5 seconds in light 
turbulence and 4.25 seconds in moderate turbulence, for the landing approach 
task. The configurations of this study have been used in Figure 2-14 to 
show the effect of static margin (as varied by center-of-gravity location 
and horizontal tail size) on time-to-double-amplitude. If the times indi- 
cated above are used to enter the chart, a minimum static margin of about 
minus 11 or minus 12 percent MAC is indicated for the light turbulence case 
and about minus 6 percent MAC for the moderate turbulence case. It should 
be noted, however, that in Reference 5 the authors cautioned about effects 
of pitch-control sensitivity, pitching-moment nonlinearities, pilot train- 
ing, and visibility conditions. 

The military flying qualities specification, Reference 2, sets down 
requirements- for longitudinal short-period dynamics. The short-period fre- 
quency requirement is given as a function of the acceleration sensitivity, 
n/a, which is not dependent upon center-of-gravity location. The Level 2 
boundaries are shown in Figures 2-15 and 2-16 for the landing approach and 
cruise flight cases, respectively. It is seen in Figure 2-15 that in the 
landing approach case the Level 2 frequency requirement is not met at centers 
of gravity aft of approximately 35 percent MAC. The most aft center-of- 
gravity location for compliance with the Level 2 frequency requirement in 
cruise flight is about 43 percent MAC, as shown in Figure 2-16. 

2.5 Flying Qualities Analysis of Candidate Augmentors 

Section 5 contains description of the control-law development process 
which in the early stages involved more than 25 laws. This section contains 
an evaluation of those control laws which were selected in Section 5. 

Satisfactory long-period, or phugoid, characteristics were obtained 
by matching the time response to that of the DC-10. Short-period dynamics 
were investigated through use of the "Bandwidth Model." Because it was 
found that the selected control laws (augmentors) provide the same short- 
period characteristics, they are discussed collectively in this paragraph. 
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FIGURE 2-16. LOCUS OF ROOTS AS CG IS MOVED AFT, CRUISE FLIGHT - 
BASIC TAIL AREA 

In Figure 2-17 the effect of augmentor operation on pitch-tracking is 
shown for the landing approach case with the center of gravity located at 
40 percent MAC. The unaugmented aircraft is well in the Level 2 area, and 
in fact received a mean pilot rating of 5.4 in the first simulator test. 

With the RSSAS in operation, the predicted flying qualities fall into Level 1. 
Further validation of the short-period characteristics is furnished by 
reference to the frequency and damping requirements given in the military 
flying qualities specification, Reference 2. In this case, the minimum 
frequencies are specified in terms of the normal acceleration sensitivity, 
n/a. However, because the augmentation system has no direct lift controller, 
n/a is fixed for each flight condition (see Tables 2-4 and 2-5). It should 
be noted that frequency requirement is regarded as unduly strict with respect 
to large aircraft. Many such aircraft with demonstrated good flying 
qualities have difficulty meeting this requirement. In Figure 2-18 the effect 
of augmentation system operation on the aircraft in landing approach is shown 


28 




LANDING APPROACH, CG AT 40% MAC 
© UNAUGMENTED AIRCRAFT 
& AUGMENTED AIRCRAFT 

LEVEL 3 


LEVEL 2 


LEVEL 1 


PILOT PHASE COMPENSATION, (DEG) 

FIGURE 2-17. EFFECT OF AUGMENTATION SYSTEM ON PITCH TRACKING CONTROL 


MIL F-8785B 
LEVEL 1 

REQUIREMENT- 


© UNAUGMENTED 
AIRCRAFT 

A AUGMENTED 
AIRCRAFT 

CG AT 40% MAC 


)OJ 

(RAD/S) 


. MIL F-8785B 
LEVEL 2 
REQUIREMENT 



o (RAD/S) 

FIGURE 2-18. MILITARY SHORT-PERIOD REQUIREMENTS - LANDING APPROACH 



for the design center-of-gravity location of 40 percent MAC. The augmented 
aircraft is marginally Level 1, using this criterion. In the less critical 
cruise flight condition, use of the augmentor brings the frequency well into 
the Level 1 area, as shown in Figure 2-19. 

While all of the control laws provided satisfactory performance in 
terms of response to elevator inputs, there was concern regarding the response 
to other inputs. There was particular concern about thrust inputs because of 
the large thrust-moment arm associated with the wing-mounted engines (see Figure 
2-3). To illustrate the effect. Figure 2-20 is presented showing the response 
of the unaugmented aircraft (solid line) to a sudden thrust reduction while 



FIGURE 2-19. MILITARY SHORT-PERIOD REQUIREMENTS - CRUISE FLIGHT 
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FIGURE 2-20. EFFECT OF THRUST CHANGE ON AIRCRAFT RESPONSE 
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in the landing approach. The thrust reduction amounts to approximately 
half of the thrust required for the landing approach. The most obvious 
effect is the immediate pitch-down and loss of altitude that occurs. The 
incorporation of a thrust compensation feature in the augmentors effectively 
controls the thrust pitching moments as shown by the dashed line in Figure 
2-20. The response for control law Number 5 is shown in this figure, but 
the other control laws are similarly effective. 

2.6 Summary of Aerodynamic Center Margin Results 
from the Motion-Base Tests 

The results of the motion-base simulator tests discussed in Section 3 are 
summarized below. The results reflect an interpretation of the pilot opinions 
that weigh the results to the worst mean ratings in the array of tests. This 
interpretation recognizes that the worst means are probably representative of 
a significant portion of the line pilot population, and that a safety-related 
requirement should consider this portion of the population. The severity of 
the interpretation has a significant effect on the allowable stability margin. 
For example, in the landing approach, the use of mean pilot ratings would 
allow a negative 6-percent static margin compared to a negative 2.5 percent 
based on the worst mean ratings. 

From the simulation, the minimum acceptable aerodynamic center margin for 
landing approach was determined to be a negative 3.1 percent MAC. The aero- 
dynamic center margin is determined by subtracting from the static margin the 
difference between the neutral point and aerodynamic center, defined by the 
distances from the aft limit of the aircraft center of gravity. The static 
margin as determined from the simulator was negative 2.5 percent MAC; the 
difference between the neutral point and aerodynamic center was negative 
0.6 percent MAC. For the nonterminal flight phases, the minimum acceptable 
aerodynamic center margin is a negative 4.5-percent MAC. Although less 
instability can be tolerated during landing approach, it is not necessarily 
the critical condition for tail sizing and setting the aft center-of-gravity 
limit. For a fixed tail size and center-of-gravity position, an aircraft 
has more static stability (or less instability if unstable) at landing speeds 
than it does at high-speed conditions. The reduction in static stability 
as airspeed is increased is caused by the variation in aeroelastic effects 
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with variations in airspeed. As a result, the critical condition for tail 
sizing is determined by how the stability level naturally varies with flight 
phase, as well as how the requirement for stability varies with flight phase. 
This is shown graphically and in a typical fashion in Figure 2-21. In this 
figure, the decrease in aerodynamic center margin - as speed is increased from 
the landing-approach range to the high-speed end of the nonterminal range — is 
greater than the change in the allowable margin. In this typical case, the 
critical tail sizing condition would be at high speed in the nonterminal flight 
phase, even though the actual level of required stability is not as great. 

As previously mentioned, the minimum allowable aerodynamic center margin 
is a negative 3.1-percent MAC for landing approach and a negative 4.5-percent 
MAC for the nonterminal flight phases, a difference of 2.6-percent MAC. The 
normal variation of the actual margin with airspeed for a subsonic jet trans- 
port is orders-of-magnitude greater than 2.6-percent MAC, when the extremes of 
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the speed range are considered. Therefore, the critical condition for tail 
sizing in actual practice is high speed in the nonterminal flight phase. 

Within this phase, the most critical point occurs at the highest equivalent 
airspeed/dynamic pressure within the operating envelope where aeroelastic 
losses are great, and at relatively low altitudes and Mach number where stabil 
ity has not increased significantly due to compressibility effects. 

2.7 Fuel Savings 

The fuel savings relative to an EET-type aircraft configured with current 
levels of inherent stability can be determined from Figure 2-22. This figure 
uses data from the study described in Paragraph 2.2. The fuel savings are 
based on the tail size which provides the required aerodynamic center margins 
at the critical condition of high airspeed and relatively low altitude. 

Using the aerodynamic center margin recommendation from Paragraph 2.6 of 
minus 4.5 percent, the fuel savings are 2.8 percent. Relative to the EET 
baseline described in Paragraph 2.1, the fuel savings would be three-quarters 
of one percent. The savings are significant. 

4 


3 


BLOCK 
FUEL , 

SAVINGS 
(PERCENT 

1 
0 

-10 -5 0 5 10 

AERODYNAMIC CENTER MARGIN 
(PERCENT MAC) 

FIGURE 2-22. EFFECT OF AERODYNAMIC CENTER MARGIN ON FUEL SAVINGS 



34 




SECTION 3 

MOTION-BASE SIMULATOR TESTS 


3.1 Test Facility and Methodology 

Simulations of the aircraft and of the system were conducted in order 
to explore the relationship of flying qualities and aircraft characteristics 
with and without the RSSAS. 

The tests were conducted on the Douglas six-degree-of-freedom motion 
simulator. The mechanism supports a complete simulated transport cockpit and 
provides realistic motion cues. Visual simulation for the cockpit is 
available from a Redifon visual flight attachment. A detailed description 
of the simulator facility is given in Appendix 2. 

In the first simulation, flying qualities of the unaugmented aircraft 
were examined through most of the flight envelope. This examination led 
to emphasis being placed on the cruise flight and landing approach conditions. 
Pilot ratings were obtained for a number of configuration variations and in 
conditions of turbulence or calm. Five test pilots, experienced in DC-10 
and other transport handling evaluations, participated in the experiment. 

In the second simulation, flying qualities of the augmented aircraft 
were examined in landing approach and cruise flight. Some reversion 
conditions were examined, together with configuration variations and turbulence. 
Six test pilots took part in the test. 

The programming for the simulation utilized the large-flight-envelope 
data previously developed, thereby permitting simulated flight through most 
of the flight envelope as well as permitting flap, leading-edge-device, 
and landing gear extension and retraction. In this way, representation of a 
realistic transport flight was attempted. The scope of the study did not 
permit investigations to revise the aircraft configuration. However, relatively 
minor improvements in the aerodynamic characteristics were made through the 
program in response to adverse comment. 

In analyzing the test results, it was necessary to use mean (average) 
pilot ratings to define the trends of the data. All the data points 
describing the pilot rating results represent the mean of a number of 
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individual pilots. One interpretation of a curve fairing through these 
points weights the data equally. However, it has been argued that, for the 
purpose of establishing stability limits or boundaries, the worst averages 
should be used to fair the interpretive curve. The argument states that 
each of the "worst" points in the sample represents a significant portion of 
the airline pilot population, and that the boundary should consider these 
pilots. Such an interpretation is also included in the presentations of 
pilot ratings, and is used for the final evaluation of fuel savings. The 
presentations which follow indicate "mean" curves with solid lines and "worst 
mean" curves with dashed lines. 

3.2 Tests of the Unaugmented Aircraft 

3.2.1 Test Description. - The pupose of the first test was to 
determine the longitudinal condition which met the minimum standard of 
flying qualities laid down for the unaugmented aircraft. 

In the initial procedure, each evaluation pilot became familiar with 
the basic configuration (center of gravity at 25 percent MAC) by performing 
approaches, landings, go-arounds, climbs to altitude, maneuvers at altitude, 
descents, and stalls. Additional familiarization was provided by having 
the pilots repeat the process for an aft center-of-gravity case (center of 
gravity at 40 percent MAC). No pilot ratings were taken during this portion 
of the experiment, but pilot comments were solicited. From the commentary it 
was determined that the remainder of the test should concentrate on the landing 
approach and the cruise flight conditions. The lateral -directional character- 
istics were recognized as unsatisfactory during this period but time did not 
permit the problem to be pinpointed and corrections to be made. The 
problem was later indentified as being due to improper spoiler -- aileron 
mixing. The result was low lateral control sensitivity for small wheel 
deflections. 

All configurations were evaluated in both a calm air environment and in 
the presence of simulated atmospheric turbulence. The turbulence model used 
is in the Dryden form and is a si ightly modified version of that described 
in Reference 6. For the landing approach cases, the RMS vertical gust 
intensity was 2.13 m/s (7.0 ft/sec). Pilots described this level as "moder- 
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ate," or "moderate to heavy," but their opinion is probably based to a large 
extent on motion cues, and in any ground-based simulator there is necessarily 
considerable motion attenuation. It is believed that this intensity of tur- 
bulence would be more accurately described as "heavy" or "severe" if full 
motion cues were felt by the pilot. In fact, the proposed revision (Refer- 
ence 7) to the military flying qualities specification suggests that a RMS 
vertical gust component of 2.3 m/s (7.6 ft/sec) be used for the threshold 
of "severe" turbulence for low altitude flight. For the cruise condition, 
the RMS turbulence value was 1.5 m/s (5.0 ft/sec). This was generally 
described as "moderate" which corresponds to the "moderate" stated in 
Reference 7. 

Following the familiarization stage, the formal evaluations commenced. 

Five Douglas pilots participated. The configurations tested were the 15 
combinations of center-of-gravity location and tail size previously de- 
scribed. Variations in tail size were included in the matrix to identify 
problems that might be attributed to deficient pitch control at various 
stability levels. As mentioned previously, a listing of the more pertinent 
flying qualities parameters for the 15 test configurations, for landing 
approach and for cruise, is presented in Table 2-4. 

A description of the pilot task for the landing approach condition is 
presented in Figure 3-1. The conditions for the cruise flight evaluations 
are: altitude = 10,668 m (35,000 ft), Mach number = 0.80, in the clean 

configuration. In the cruise condition, pilots were asked to make altitude 
changes of 457 m (1500 ft), speed changes of ±10 m/s (20 kn), and steep turns 
using about 0.785 rad (45 degrees) of bank. The evaluations were made with 
both smooth air and with a moderate turbulence level [a w = 1.5 m/s (5.0 ft/sec)]. 

During the experiment, three pilots evaluated all of the 15 configurations, 
one evaluated 13 of the configurations, and one evaluated 7 of the configurations. 
An evaluation consisted of flight at the cruise condition, with calm air and 
with turbulence, and landing approaches, with and without turbulence. Several 
approaches could be made if the pilot felt it necessary. At the conclusion of 
each run, the pilot was interrogated by the test engineer who recorded 
the comments on a debriefing form. Pilot ratings were given for each of the 
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configurations and turbulence conditions. The Cooper-Harper scale was used 
(see Figure 2-12 and Reference 1). 

3.2.2 Flying Qualities Evaluation. - Figure 3-2 shows the effect of 
static margin on mean pilot rating for the landing approach task in turbu- 
lence. The data represent the mean of five individual pilots. As previously 

explained, two fairings through the data have been made: one considering all 

the means (solid line), and the other considering only the worst of the 
means (dashed line). Reading the dashed curve at a mean pilot rating of 6.5 
establishes the minimum acceptable static margin at minus 2.5 percent MAC. 

The corresponding minimum time-to-doubl e-amplitude, 1S found from Figure 
2-14 to be approximately 7 or 8 seconds, depending on the tail area. It will 
be noticed that the curve in the area of interest (where pilot rating is 
approximately 6.5) is relatively flat. This flatness causes the acceptable 
limit to be very sensitive to the manner in which the curve is faired. 
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FIGURE 3-2. EFFECT OF LONGITUDINAL STABI LITY ON MEAN PI LOT RATING - 
LANDING APPROACH 


In the landing approach condition, the aerodynamic center is only 
0.6 percent MAC forward of the neutral point. Therefore, the acceptable 
aerodynamic center margin for landing approach is minus 3.1 percent MAC 
[(-2.5) + (-0.6)]. 

No firm conclusions can be drawn regarding the effect of horizontal tail 
size, although there is some indication that the smallest tail tested (70 
percent of basic) develops too little control power for the very unstable 
cases. It should be noted however, that the values of maximum pitch 
acceleration which each of the tails can produce, noted in Figure 3-2, are 
not particularly low by transport aircraft standards. Pitch acceleration 
capability is seldom critical for transport aircraft in which the tail is 
sized by stability considerations. Therefore, the few pilot comments 
relating to poor controllability may have had more to do with decreased pitch , 
control sensitivity than with inadequate maximum control power. This 
sensitivity is of no concern for the stability range of interest in this 
study. The reduced tail area also provided less pitch damping, which possi- 
bly contributes to degraded pilot ratings. However, no pilot comments re- 
lated to this specific effect. 
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The effect of turbulence on pilot rating is shown in Figure 3-3 where 
the two curve fairings have been constructed using equally weighted data points 
(the upper curve corresponds to the solid curve in Figure 3-2). The turbu- 
lence effect for the stable cases is approximately one pilot rating unit 
while the increment for the unstable cases is about two units. 

In Figure 3-4 the pilot rating data for the landing approach case in 
turbulence is shown on the pitch-tracking criterion chart. The agreement 
between the ratings and the boundaries of the criterion is generally good, 
particularly near the Level 2 boundary. The ratings near the Level 1 
boundary are somewhat worse than expected, probably because of the poor 
lateral -directional characteristics. 

For the cruise flight condition, maneuver margin was chosen as the metric 
of stability rather than static margin. Maneuver margin is more appropriate 
for this condition, in which load factor changes provide important cues for 
the pilot. In Figure 3-5 the effect of maneuver margin on mean pilot rating 
is shown for flight in turbulent air. As before, two fairings have been 
drawn through the data. Using the upper (dashed) line, which weights the 
poor ratings more heavily, the minimum acceptable maneuver margin for a pilot 
rating of 6.5 is found to be approximately minus 1 percent MAC. 

The effect of turbulence on pilot opinion of maneuver margin is 
presented in Figure 3-6 for the cruise flight condition. The effect is quite 
small, with the stable cases indicating an incremental pilot rating of 
less than half a unit and increasing to nearly one unit for the unstable 
cases. This small effect is attributed to the rather low precision required 
in the cruise piloting task. 

Knowledge of the minimum acceptable aerodynamic center stability is 
necessary to determine fuel savings due to relaxed stability from the 
parametric data of Paragraph 2.6. In Figure 3-7, the effect of aerodynamic 
center margin on the mean pilot rating is presented for cruise flight in 
turbulent air. Using the curve faired through the poorer mean ratings 
yields a minimum acceptable aerodynamic center stability level of about minus 
4-1/2 percent MAC. While these ratings are for a piloting task involving 
cruise flight at 10,668 meters (35,000 feet), the limit of minus 4-1/2 percent 
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FIGURE 3-5. EFFECT OF LONGITUDINAL STABILITY ON MEAN PILOT RATING - CRUISE FLIGHT 
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FIGURE 3-6. EFFECT OF TURBULENCE AND STABILITY ON MEAN PILOT RATING — CRUISE FLIGHT 
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MAC also is judged appropriate for other nonterminal flight phase tasks in 
commercial transport operations. 

3.3 Tests of the Augmented Aircraft 

3.3.1 Test Description. — A second motion-base simulator test was 
conducted with the purpose of examining the flying qualities and pilot 
evaluations of three control laws, certain augmentation system features, 
and several reversion conditions. The control laws tested were eeua, 

00a, and a in landing approach and a in cruise flight. Evaluations were 
made of the augmentor performance with varying levels of augmentor elevator 
authority: full, 0.087 rad (5 degrees), and 0.035 rad (2 degrees). (A 

limited augmentation elevator authority is normally desirable to minimize 
the consequences of augmentor failure. The primary pilot elevator authority 
was not limited during these tests.) Tests were conducted in which the 
pilots evaluated a simulated auto trim failure, i.e., the pilot was forced 
to manually trim the aircraft during large trim change maneuvers. Failure 
of the thrust compensation feature of the augmentor (0/thrust damper off) 
was also simulated with the critical case being the go-around maneuver. Other 
failure conditions which were evaluated included passive total failure of each of 
the augmentors and augmentor failures in which a reversion from one control 
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law to another occurred. During individual test runs, the pilot was not aware 
of which sensor had been failed. 

Evaluations of the unaugmented aircraft were made at two center-of- 
gravity locations: 25 percent MAC and 40 percent MAC, except for a - brief 

look at an off-design case with the center of gravity at 50 percent MAC. 

The basic horizontal tail was used in all cases. 

The simulated aircraft was the same as used in the first simulation, 
except that the troublesome lateral -directional characteristics were im- 
proved by an increase in lateral control sensitivity for small deflections. 

Most of the evaluations were made in the presence of turbulence as described 
for the first test. The flight conditions used in this experiment were, 
again, landing approach and cruise, but some additional conditions were 
investigated. Several emergency descents with speed brakes extended were 
made and approaches to stalls at an intermediate altitude were performed. 

Six Douglas pilots participated in the evaluations. 

Table 3-1 lists the minimum test configurations sequence that was 
provided for each of the evaluation pilots. 

3.3.2 MBS RSSAS Configuration. — The RSSAS simulation for the 
augmented motion-base flying qualities evaluation was a single computational 
channel configuration as shown in the simplified block diagram of Figure 3-8. 
This included: (1) control law computation and elevator control to provide 
aircraft static stability and to compensate for the pitching moment re- 
sulting from engine thrust changes, and (2) trim commands, both automatic and 

manual, to offload steady-state elevator augmentation commands. Three 
different control laws, 0 0* u« (control law No. 1), Ho (control law No. 3) 
and a- (control law No. 5), were implemented from the eeuo 

control law family. They represent a progression of sensor failures starting 
with a full -up array, then airspeed (u) failed and finally the attitude 
sources (ee) failed, leaving the single type, angle-of-attack (a) control 
law. Effects of variations in sensor characteristics were not evaluated on 
the MBS, but have been studied during the DETAC analysis (Reference 5.5.3). 

To present the status of the system in the cockpit, a combined RSSAS caution/ 
warning annunciator and trim director indicator, as shown in Figure 3-9, 
was installed on the left side of the pilot's forward instrument panel. 
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TABLE 3-1 

MBS TEST SEQUENCE 

I. Landing Approach/Go-Around (if noted) 

Center of 



Augmentor 

Gravity 

Turbulence 

Control Law 

Other 

1. 

Off 

25% 

ff w 

= 

0 


- 
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2. 

Off 

m 

a w 

= 

0 


- 

- 

3. 

Off 

40% 

a w 

= 

2.3 

(7) 

- 

- 

4. 

On 

40% 

a w 

= 

2.3 

(7) 

1 

- 

5. 

On 

40% 

a w 

= 

2.3 

(7) 

3 

- 

6. 

On 

40% 

a w 

= 

2.3 

(7) 

5 
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°w 

ST 

2.3 

(7) 
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11. 

On 
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e/Thrust damper 
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12. 

On 
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5* 
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13. 
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FIGURE 3-9. RSSAS CAUTION/WARNING AND TRIM DIRECTOR INDICATOR 
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Control of the RSSAS configuration was accomplished by means of a 
programmable test operator panel shown in Figure 3-10. The configurations 
evaluated and the control unit-augmentor interface are described with the 
aid of the RSSAS diagram shown in Figure 3-11. (This diagram is developed 
in Section 6 of this report.) Selection of the augmentor control law was 
accomplished by pushing one of the top three control panels' pushbuttons, 
which in turn provided an input to the select logic (Point A, Figure 3-11) 
corresponding to the sensor validities necessary for the desired control 
law. With the use of the thumbwheels, the maximum augmentor series elevator 
command authority at point B could be set to 0.035 rad (2°), 0.087 rad (5°), 
0.1745 rad (10°) or full authority. 

The toggle switches along the left side of the control unit 
inserted failure conditions. The top switch input corresponded to a series 
actuator failure by opening the signal path at point C. This resulted 
in an "RSASS inop" light on the RSSAS caution/warning panel. The middle 
toggle switch opened the thrust input to the augmentor at point D. The 
augmentor responds to this by "holding" the last N-j value in the pitch/thrust 
compensation calculation and provides a "Thrust Damper Inop" warning. The 
bottom switch opens the horizontal stabilizer position feedback at point E, 
which is detected by the trim actuator failure detection circuit. This pro- 
vides an RSSAS Trim Inop warning and activates the manual trim director 
indicator. 

The toggle switches on the right side of the controller were used to 
make minor changes to the augmentor configuration. The top switch opened 
the horizontal stabilizer signal path at the feedforward input to the 
observer at point F. This configuration was examined in an attempt to 
simplify the RSSAS-horizontal stabilizer interface. This is desirable, 
since not all stabilizer movement (only pilot-initiated)should be input to 
the observer and it may be difficult to extract the necessary data with the 
accuracy needed, especially during failure conditions. All pilot ratings 
were, however, taken with the stabilizer input in its normal position. The 
middle switch was used to change the feedforward gain at point G from the 
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value calculated by the augmentor, to a fixed value of 1. The augmentor 
gain is selected to provide the DC-10 pitch rate to control column de- 
flection while the unity gain results in the normal EET pitch rate to 
control column deflection. Pilot evaluation indicated a preference for 
the EET response and most tests were flown with the gain set to 1. . 

3.3.3 Flying Qualities Evaluation. — In Figure 3-12, pilot ratings 
obtained in the second simulator test are shown together with data from 
the first test. The data are for the landing approach case in the presence 
of turbulence. 

Although the pilot commentary indicated that the lateral control 
characteristics were considerably improved over those used in the first 
test, the pilot ratings did not reflect a significant change for the 
two center-of-gravity locations which were evaluated. It is believed 
that although the lateral characteristics during the first test were 
objectionable, because longitudinal properties were the major concern the 
pilots attempted to overlook the deficiencies when assigning pilot ratings. 

The slightly higher (worse) mean pilot rating that was obtained for the 
near neutral stability case tends to support the upper, more conservative, 
curve fairing that was used to establish the minimum acceptable stability 
level at 2-1/2 percent MAC (pilot rating of 6.5). A similar presentation 
is made for the calm air case in Figure 3-13. Again the task is the 
landing approach. The curve from the first test is based on equal 
weighting of the data points and shows good correlation with the two data 
points from the second test. 

In the cruise flight condition, only a brief evaluation of the 
unaugmented aircraft was conducted. With the center of gravity located 
at 40 percent MAC, this case represents an augmentor failure during a prolonged 
flight, and the question asked of the pilots was, "Would you continue to 
your destination or land as soon as possible?" Of the five pilots who 
evaluated this condition, only one had doubts that the flight should 
be continued. He commented that some pilots might want to discontinue 
the flight if the conditions persisted (moderate turbulence and the 
center of gravity located at the aft limit, 40 percent MAC). The other 
four evaluation pilots felt that there would be no problem. Opinions 
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FIGURE 3-12. EFFECT OF LONGITUDINAL STABILITY ON MEAN PILOT RATING - 
LANDING APPROACH (COMPARISON OF DATA FROM FIRST AND 
SECOND TESTS) 
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FIGURE 3-13. EFFECT OF TURBULENCE AND STABILITY ON MEAN PILOT RATING - LANDING APPROACH 
(COMPARISON OF DATA FROM FIRST AND SECOND TESTS) 
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varied from "not bad," to "OK", and "flies great." Actually, no problems 
should be expected since the maneuver margin at this center-of-gravity 
location is nearly 13 percent MAC. In Figure 3-5, the results of the first 
test showed a mean pilot rating of less (better) than 4.0 for the same 
center-of-gravity location and flight condition. 

Three augmentors. No. 1, No. 3, and No. 5, were evaluated in the 
landing approach in the presence of turbulence. These are described in 
Section 5. It is interesting that although several of the evaluation pilots 
indicated a clear preference for one augmentor over another, the pilot 
ratings for each of the three averaged 3.8. For a similar center-of-gravity 
location and flight condition, it was shown in Figure 3-12 that the mean 
pilot rating for the unaugmented aircraft was 6.0. In the same figure, 
the mean pilot rating for a center-of-gravity location of 25 percent MAC is 
4.0, about the same as the 3.8 given for the augmented aircraft for 
a center-of-gravity location of 40 percent MAC. 

In cruise flight, only augmentor No. 5 was evaluated. Because the 
unaugmented aircraft was rated satisfactory in this flight condition, there 
was little room for improvement, and none was observed. The pilot who 
expressed slight doubts about the unaugmented aircraft in cruise, observed 
the same weakly damped oscillation with the augmentor in operation. 

Simulated stalls were performed at about 4600 m (15,000 ft) altitude 
in clean and landing configurations, both with augmentor No. 5 in operation 
and unaugmented. All of the stalls were easily recoverable (no lateral - 
directional separation effects were simulated). The only problems 
encountered involved the addition of thrust when recovering from power-off 
stalls with the unaugmented aircraft. Unless the thrust was added care- 
fully, the nose-up thrust pitching moment made it difficult to get the 
nose down. 

For the test involving simulated autotrim failure, the manual RSSAS 
trim director (see Paragraph 3.3.2) was used. The manual RSSAS trim 
director was activated whenever the autotrim system could not properly 
off-load the augmentor series elevator displacement. The command display 
can present an unusual situation for the pilot, since the RSSAS trim 
requirement may be in direct conflict with the pilot's primary trim 
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requirement. As an example, while the pilot may be holding nose-up 
elevator with the control column, the RSSAS trim director could command 
nose-down trim to off-load a steady-state nose-down-series elevator de- 
flection. 

The trim director was evaluated in several approaches. The pilot was 
instructed to (a) respond to the trim command, but immediate action was 
not necessary, and (b) if the trim command was in opposition to the desired 
primary trim requirement, satisfy both in any order that was comfortable. 

The test demonstrated the following: (a) trim commands are a new idea and 

not immediately natural to respond to, (b) the pilot should first satisfy 
primary trim requirements and then the RSSAS trim command, (c) the trim 
director threshold must be carefully selected to minimize nuisance or 
reversing-trim commands, and (d) a manual trim director could increase 
the pilot's workload. It is concluded that development is needed in this 
area. 

3.3.4 Other Results. — Besides establishing levels of flying quality 
for the augmented aircraft, the following significant conclusions resulted 
from the tests. 

Required Elevator Deflection — Figure 3-14 is a bar chart 
reflecting the nominal and maximum observed pilot elevator control required 
to perform specified piloting tasks with and without the RSSAS. All 
data were observed in a moderate level of turbulence. The effect of the 
augmentation was to significantly reduce the magnitude of the required 
pilot elevator command during the landing/approach and go-around maneuvers. 
The large deflections in go-around are required because of the pitching 
moment resulting from the engine thrust change. These elevator deflections 
are trimmed out if unaugmented, or satisfied by the augmentor if the RSSAS 
is engaged. During this testing, it was observed also that the augmentation 
provided control for all higher frequency aircraft disturbances; therefore, 
the higher-frequency pilot elevator response to the turbulence was 
eliminated with the RSSAS. 

Authority-Limiting - The maximum observed augmentor elevator command 
did not exceed 0.07 radian (4°) except during the thrust change of the 
go-around maneuver. With the authority limit set to 0.035 radian (2°), 
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MOTION BASE SIMULATOR TEST 



FIGURE 3-14. ELEVATOR DEFLECTION IN MODERATE TURBULENCE 

no noticeable degradation in performance was observed and the pilot flying 
qualities ratings were unchanged. Authority-limiting during go-around had 
the effect of allowing more of the natural pitching moment due to the 
thrust change. At the 0.035-radian (2°) limit, the pitch-up during go-around 
was significant but not objectionable. Some pilots, in fact, preferred the 
positive pitch-up in this situation. With no augmentation, however, the 
go-around pitch-up requires immediate and constant pilot attention. This 
would indicate that the amount of lead in the initial augmentation 
command is more important than its authority for this condition. 

Ground-Air Transition - One of the "point" design conditions to 
be evaluated was the ground-air transition. This is of interest since it 
is a situation where the augmentation system may not have sufficient 
aerodynamic data with which to make its necessary calculations. This is 
due to the fact that the augmentation system, upon engagement, has synchronized 
to the conditions of a trimmed aircraft. The aircraft, however, makes a 
large positional and dynamic change in order to establish a trimmed flight 
path. 
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The ground-air transition was accomplished by making a touch-and-go 
maneuver out of a landing sequence. During the first test, the augmentor 
was allowed to continuously compute and control during the landing, ground 
roll, and liftoff. The result was a large nose-down elevator command out of 
the augmentor after rotation. What had actually happened was that the RSSAS 
autotrim had continuously run nose-down during the ground roll in response 
in the augmentor elevator command to maintain the approach trim conditions. 

The solution to this problem was to synchronize the augmentor during 
the ground roll and then again allow control at landing gear liftoff. With 
this mechanization, the augmentor provided the proper control for all 
subsequent ground-to-air tests. No additional time delays after liftoff 
were judged necessary in order to allow the aircraft time to settle on a 
trimmed condition. 
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SECTION 4 

RELIABILITY AND SAFETY CRITERIA AND ANALYSIS 

4.1 Baseline and Criteria 


4.1.1 System Definition 

DC-10 Baseline. - The reliability goals established for the EET stability 
augmentation system are based on comparable DC-10 systems capability. The 
addition of a totally new and somewhat complex system impacts the aircraft 
flight control system and it is on this level that the goals and comparisons 
have been made. The flight control system evaluated includes the primary con- 
trol components (surfaces, actuators, cables and controllers), the flight 
guidance systems (automatic controls, dampers and limiters) and primary sensor 
systems (attitude, air data, etc.). Simplified schematics of the DC-10 system 
components are presented in Figures 4-1, 4-2, and 4-3. 

Items Considered. - Using the DC-10 master component list, more than 240 
components were identified as significant to consider in the reliability study. 
Appendix 3 provides a list of these items identified by name and ATA Code num- 
ber. The EET components are in most cases similar to or identical to those used 
on the DC-10. 

Major Differences. -The major differences are in (1) the flight guidance 
system where a greater degree of functional integration is used, (2) the pri- 
mary control elevator and stabilizer trim actuation, and (3) the addition of 
the augmentation system. 

4.1.2 Reliability Data Source . -The quantitative DC-10 reliability has 
been determined using in-service data recorded by Douglas. The Douglas DC-10 
data base includes over 2-1/2 million flight hours by major domestic and for- 
eign airlines. All operational and maintenance actions are recorded and 
itemized to the specific aircraft component. The specific desired system and 
component reliability data may be manipulated and extracted with the use of the 
Douglas computer program THESYS. 

THESYS is a computerized data management system. It has been specifically 
tailored for storage and retrieval of component failure data gathered from 
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commercial airline service. More than a file maintenance program, THESYS is a 
complete software package providing the create, update, and query functions, 
report generation programs, and special purpose programs necessary to support 
our data requirements. THESYS was written exclusively in FORTRAN IV to provide 
for easy modification, updating, and to preclude obsolescence. Because compara- 
tive information is often desired on other than Douglas airplanes, THESYS was 
designed to provide a repository for data obtained on any commercial aircraft. 

The THESYS Flow Chart (Figure 4-4) shows the path that data follows from 
the raw airline reports through the data system and subsequently to various 
output programs. 

The bulk of data input to THESYS comes from monthly airline removal 
reports. To facilitate the processing of this data, an airline data conversion 
program was written. This program, when combined with airline data reformatting 
programs (each tailored to a particular airline's unique reporting practices), 
is designed to process the removal reports and update the master file with a 
minimum of clerical intervention. 
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FIGURE 4-2. DC-10 FLIGHT GUIDANCE SYSTEM 
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FIGURE 4-3. DC-10 FLIGHT ENVIRONMENTAL DATA 






















FIGURE 4-4. THESYS FLOWCHART 
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An example of one of the many report formats available from THESYS is 
shown in Figures 4-5 and 4-6 for the DC-10 Yaw Computer and Auto Throttle Speed 
Computer. This report provides the Mean Time Between Unscheduled Removals 
(MTBUR) for a selected component by airline and total fleet for a calendar year. 
For each month and airline, the component flight hours and removals are printed 
so the user is aware of the sample size and any gaps that may exist in the 
reports received from the airlines. The fleet MTBUR in the far right column 
is a three-month moving average. The component MTBUR for each airline for the 
year and from initial use to date is given across the bottom row. In the 
examples shown, these two values are the same because only one year's data was 
interrogated. 

4.1.3 Reliability Factors of Interest. — There are primarily three reli- 
ability terms of interest in specifying the required system capability. The 
first is Dispatchability — the minimum capability required to begin a mission. 
The next is Mission Reliability — the probability the system will not cause an 
abort in flight. The third is Economic Reliability — the frequency of mainte- 
nance actions on the system components. 

4. 1.3.1 Dispatchability. — Dispatchability, the probability that a 
scheduled flight will not be delayed or cancelled due to equipment malfunctions, 
is a relatively complex conditional probability with many influencing parameters. 
Somewhat oversimplified, it is the combined probability of one or more faults 
occurring between the last takeoff and the next, and the probability these 
faults will be repaired in time, given that the next flight cannot dispatch 
with the fault existing. If it can, this changes the probability that the next 
succeeding flight will be delayed. 

The probability a fault will occur is influenced by the length of the 
previous flight, condition of the aircraft system, weather, and other factors. 

The probability of repair in the alloted time is influenced by such things as 
the type of station, type of flight, ground time available, spares availability, 
maintenance policy and staffing. Each of these factors has a unique distribu- 
tion pattern and these patterns vary from airline to airline. 

To establish an average condition for this study, the Dispatchability 
goal was determined using a one-year data sample from 1 October 1975 through 
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FIGURE 4-5. TYPICAL THESYS OUTPUT (FLIGHT GUIDANCE COMPUTER) 
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FIGURE 4-6. TYPICAL THESYS OUTPUT (AUTOTHROTTLE) 



30 September 1976 which included 217,535 revenue DC-10 departures. The follow- 
ing data represent all events affecting departures and flights attributed to 
the aircraft systems being compared. 


CONSEQUENCE NUMBER RATE x .10 


Delays 

0-15 minutes 

159 

0.73 

Delays 

> 15 minutes 

458 

2.11 

Cancellations 


27 

0.12 

Aborts 


11 

0.05 

Out of Service 


5 

0.02 

TOTAL 


660 

3.03 x 10 


This total corresponds to approximately one event per 330 departures. A 

_3 

goal of 3x10 was thus established as a maximum acceptable delay or cancella- 
tion probability for a new configuration including the addition of RSSAS 
functions. 


4. 1.3. 2 Mission Reliability. - Mission Reliability is the probability that 
a flight after takeoff will continue to its planned destination. It is the com- 
plement of abort probability. For the systems of interest, the DC-10 value for 
the probability of inflight abort is shown in the preceding table. A review of 
the individual aborts, however, indicates that none of the recorded aborts can 
be justified as required by the aircraft system or hardware state but were 
based on pilot judgment of the situation. The eleven aborts included in the 
data sample are itemized in Table 4-1. A review of these descriptions shows that 
a truly critical flight safety issue was not involved. Although pilot judgment 
will continue to produce aborts of the type listed for any new aircraft, it is 
anticipated that improved fault detection and monitoring should reduce the fre- 
quency by providing the crew with better information. Therefore, for the 
Mission Reliability we have used the goal of one abort in 100,000 flights, or 
a single flight abort probability of IxlO" 5 . This number is an interpretation 
of the regulatory requirements and is more stringent than the five in 100,000 
derived from the data. For a further discussion on flight safety see Para- 
graph 4.1.4. 
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TABLE 4-1 

REASONS FOR ABORTS 


1 . BOTH ATSC COMPUTERS MALFUNCTIONED SHORTLY AFTER TAKEOFF. CAUSED STALL WARNING AND 
AUTO SLAT TRIP. 

2. ONE ATSC FAILED DURING OR SHORTLY AFTER TAKEOFF. CAUSED STICK SHAKER TO ACTUATE AND 
SLAT DISAGREE LIGHT TO COME ON WHEN FLAPS WERE RETRACTED. PULLED CIRCUIT BREAKER AND 
REDISPATCHED FLIGHT. 

3. RETURNED AFTER TAKEOFF BECAUSE OF ANGLE-OF-ATTACK SENSOR PROBLEM. UNABLE TO REPAIR 
LOCALLY SO AIRCRAFT DISPATCHED AND SENSOR REPLACED AT MAIN BASE. 

4. RETURNED AFTER TAKEOFF DUE TO ATSC FAULT WHICH ACTUATED STICK SHAKER. ATSC CIRCUIT 
BREAKER PULLED AND FLIGHT REDISPATCHED. 

5. NUMBER 3 HYDRAULIC SYSTEM LOST FLUIQ DUE TO LEAK AT A HORIZONTAL STABILIZER TRIM 
MOTOR. 

6. NUMBER 1 HYDRAULIC SYSTEM LOST FLUID DUE TO LEAK IN A HORIZONTAL STABILIZER TRIM 
MOTOR. 

7. RETURNED AFTER TAKEOFF BECAUSE HORIZONTAL STABILIZER TRIM WAS INOPERATIVE. COUPLING 
HAD COME LOOSE. ALLOWING QUILL SHAFT JO DISENGAGE. 

8. AFTER TAKEOFF AND FLAP RETRACTION, SELECT FLAP-LIMIT OVERRIDE LIGHT CAME ON. REPLACED 
ACTUATOR. 

9. NUMBER 1 HYDRAULIC SYSTEM LEAKING. FOUND LEAK AT A SPOILER SERVO. 

10. RETURNED AFTER TAKEOFF DUE TO A VIBRATION IN LEFT WING AREA. FOUND INBOARD SLAT 
TRAILING EDGE RUBBING ON WING SURFACE AREA. REPOSITIONED SLAT AND AIRCRAFT CHECKED OK. 

11. MACH AIRSPEED INDICATOR FAILED. AFTER INFLIGHT CONSULTATION WITH COMPANY, AIRCRAFT 
RETURNED AND INDICATOR WAS REPLACED. 


4. 1.3. 3 Economic Reliability. — MTBUR is often used as an indicator of 
economic reliability because it indicates the frequency of maintenance actions 
performed on a system, and suggests the level of spares, staffing, skills, 
etc., required to support the system. 

All of the items listed in Appendix 3 were interrogated through THESYS to 
determine the contribution their overall combined MTBUR has on DC-10 economic 
reliability. Based on this evaluation, an MTBUR of close to 70 hours was 
established. This means that one of the listed items is removed from a DC-10 
on the average of once every 70 flight hours. Using the DC-10 as the baseline 
for acceptable economic reliability, the goal for the systems considered in 
this study was set at a total MTBUR of no less than 70 hours. The additions, 
deletions, and changes to the DC-10 components resulting from the study con- 
figurations were tabulated and researched to provide an estimate of the equiva- 
lent EET MTBUR. 

4.1.4 Definition of Safety Factors. - Various approaches are in use 
among civil and military agencies for controlling the safety level of active 
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or augmented primary control systems. These approaches have required evaluation 
and reconciliation. Generally, the current status of these approaches is as 
follows: 

(a) No special civil regulations or advisory circulars currently exist 
that are directed specifically at relaxed stability designs. FAR 

25.671 and 25.672, together with the prevailing interpretation of 
25.1309, must be extrapolated to cover relaxed stability designs 
with active controls. 

(b) Civil regulatory agencies do not define flying qualities in the 
detail that MIL-F-8785 and MIL-F-9490D do, but rather relate the 
allowable degradation to the effect on the outcome of the flight. 

For example, FAR 25.671 states the airplane must be "capable of 
continued safe flight and landing . . . within the normal flight 
envelope, without requiring exceptional piloting skill or strength." 
This condition must prevail after any single failure or combination 
of failures not shown to be extremely improbable. Likewise, FAR 

25.672 states that after any single failure of a stability augmenta- 
tion system or other powered control system the airplane must be 
"safely controllable" and its basic flight characteristics must not 
be "impaired below a level needed to permit continued safe flight 
and landing." 

(c) The British Civil Aviation Authority (CAA) and the European Joint 

Aeronautical Regulations (JAR) have published quantitative probability 

requirements for use in analytical safety assessment of systems. The 

FAA philosophy is basically in agreement with CAA Paper No. 670 and 

JAR 25.1309, but no official publication quantifying the probability 

expressions found in various FAR's has yet been issued. Figure 4-7 

depicts the apparent consensus of the three organizations. The FAA 

-9 

is currently endorsing the view that the approximate 1x10 proba- 
bility of catastrophic loss is "per flight or flight-hour."* This 
means that if the aircraft is exposed to the hazard for a flight 

Occasionally this has been expressed as "For each trial or hour of exposure." 
The interpretation is the same for both. 
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CATASTROPHIC 
TOTAL LOSS 

LOSS OF LIFE 

NUMEROUS 

INJURIES 

EXTENSIVE 

DAMAGE 

POSSIBLE 

PASSENGER 

INJURIES 

IMMEDIATE 

LANDING 

EMERGENCY 

PROCEDURES 


OPERATIONAL 

LIMITATIONS 

CONCERN 


NUISANCE 


NORMAL 



PROBABILITY OF THE OCCURRENCE (LOG SCALE) 
(FOR EACH TRIAL OR HOUR OF EXPOSURE) 


FIGURE 4-7. RELATIONSHIP BETWEEN THE CONSEQUENCE OF FAILURE AND THE PROBABILITY 
OF THE OCCURRENCE 


duration longer than one hour, the event risk probability for a 

-9 

flight may be greater than 1x10 . For additional discussion on 

this subject, see Appendix 4. 


(d) In contrast to (a) through (c) above, the two military specifications 
are relatively precise in relating specific quantitative probability 
requirements to subjective flying quality criteria such as the Cooper 
Rating Scale. The military is also, understandably, somewhat more 
lenient in their quantitative requirements for the probability of 
undesired events. 


4.1.5 Formulation of Safety Factors. — Figure 4-8 illustrates the various 
measures for rating aircraft safety as they relate to flight control systems 
and handling qualities. The figure attempts to correlate the civil and mili- 
tary quantitative risks with a suitable qualitative measure of flying quality 
such as the levels defined in MIL-F-9490D. The Cooper-Harper Rating, as 
evolved from NASA TN-D-5153 dated April 1969, is also correlated. 
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COOPER 

HARPER 

RATING 

MIL-F-8785B 
FLYING QUALITIES 
LEVEL 

MIL-F-9490D FCS 
OPERATIONAL 
STATES 

JAR-25 AND CAA 
PAPER NO. 670 
OCCURRENCE 
EFFECTS 

PROBABILITY OF ENCOUNTERING (TRANSPORT AIRCRAFT) 

LIKELY OUTCOMES 

MIL-F-8785B 

MIL-F-9490D 

CURRENT APPARENT OUTLOOK 

FAA 

CAA/ JAR 

T TO 3.5 

1 

NORMAL STATE 
FOR OPERATIONAL 
ENVELOPE 

1 

(OPERATIONAL 

ENVELOPE) 

NORMAL 

NORMAL 

NORMAL 

NORMAL 

NORMAL 

FLIGHT PLAN OR 
MISSION COMPLETED 

3.5 TO 6.5 

2 

NORMAL STATE 
FOR SERVICE 
ENVELOPE 

I (SERVICE 
ENVELOPE) 

II (OPERATIONAL 
ENVELOPE) 

MINOR 

<1 x 10 -2 
PER FLIGHT 

<1 x 10 -3 

PER FLIGHT 
(FCS ONLY) 

UNDEFINED 

>1 x 10 -5 
PER FLIGHT OR 
FLIGHT HOUR 

FLIGHT PLAN OR 
MISSION COMPLETED 

6.5 TO 9* 

3 

II (SERVICE 
ENVELOPE) 
III 

MAJOR 

SIGNIFICANT 

<1 x 10 -4 
PER FLIGHT 

NOT 

SPECIFIED 

<1 x 10 -5 
PER FLIGHT OR 
FLIGHT HOUR 

1 x 10 -3 TO 
1 x 10 PER 
FLIGHT OR 
FLIGHT HOUR 

FLIGHT PLAN 
ABORTED; POSSIBLE 
INCIDENT 

10 

WORSE THAN 3 

IV 

(EMERGENCY 

LANDING 

POSSIBLE) 

MAJOR 

HAZARDOUS 

NOT 

SPECIFIED 

NOT 

SPECIFIED 

UNDEFINED 

1 x 10I 7 TO 
1 x 10 PER 
FLIGHT OR 
FLIGHT HOUR 

INCIDENT OP 
ACCIDENT; INJURIES 
POSSIBLE LOSS OF LIFE 

WORSE 

THAN 

10 

WORSE THAN 3 

V 

(AIRCRAFT LOST) 

CATASTROPHIC 

NOT 

SPECIFIED 

<5 x 10 -7 
PER FLIGHT 
(FCS ONLY) 

~1 x 10 -9 PER 
FLIGHT OR 
FLIGHT HOUR 

<1 x 10 -9 
PER FLIGHT OR 
FLIGHT HOUR 

TOTALLY DESTROYED; 
MULTIPLE DEATHS 


OPERATIONAL ENVELOPE ( M I L-F-8785B) 

THE BOUNDARIES IN TERMS OF SPEED, ALTITUDE AND LOAD FACTOR 
WITHIN WHICH THE DEFINED MISSION FOR EACH FLIGHT PHASE MAY 
BE ACCOMPLISHED. 


SERVICE ENVELOPE (Ml L-F-8785B) 

THE BOUNDARIES IN TERMS OF COMBINATIONS OF SPEED, ALTITUDE, 
AND NORMAL ACCELERATION DERIVED FROM AIRPLANE LIMITS. 


FIGURE 4-8. FLIGHT SAFETY CRITERIA, COMPARISON OF CURRENT GOVERNMENT STANDARDS 




Figure 4-8 is intended to stimulate discussion and generate comments 
from interested parties. It illustrates several points that must be recon- 
ciled in the near future. The civil agencies are, understandably, more con- 
servative in the quantified risk probabilities for undesired events than the 
military. The military does, however, correlate handling qualities and 
envelope restrictions to quantified risk probabilities. This the civil 
agencies have not as yet done. Some "force fitting" of civil scales to 
military scales was necessary to establish an initial handling qualities scale 
which correlates with the civil quantified risk scale. Guidance for the cor- 
relation of the Cooper-Harper scale with the two military specifications, and 
the two specifications with each other, was taken from the user's guides for 
these two specifications. 

It was necessary to identify "worse than 10" and "worse than 3" conditions 
because both 10 on the Cooper-Harper Scale and 3 in MIL-F-8785B are conditions 

from which the aircraft may be recovered to at least an emergency landing. 

-9 

The civil risk probability of 1x10 applies to catastrophic loss, which is 
postulated to be even worse than 10 or 3. MIL-F-9490D, State V, also implies 

conditions worse than 10 or 3. 

Although the comparison of standards in Figure 4-8 is somewhat subjective, 
it does reveal uniformity of philosophy among agencies. Variations are encoun- 
tered in such specifics as the level of risk, and the descriptors of a particu- 
lar condition or event. Therefore it is possible to judge design configurations 
being considered in this study in an orderly, unambiguous manner. The quanti- 
tative scale selected is that of the more conservative civil agency, specifi- 
cally the CAA/JAR scale. This is defined in more detail than the FAA scale, 
and aligns both with the Cooper-Harper Rating and the well-defined flying 
qualities scales of the two military specifications. An example of the use of 
the data may be offered. Since the unaugmented EET was designed to exhibit 
Level 2 or better flying qualities for all flight regimes, the probability of 

_5 

functional failure of the augmentation system should be in the area of 1x10 
for one hour of flight. 

4.2 Selected System Reliability Analysis 

The RSSAS function and architecture are developed in Section 6 of this 
report. In this section, the reliability of those selected architectures is 
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analyzed with a Flight Augmentation Computer (FAC) configuration which per- 
forms only the RSSAS function and another which integrates several augmenta- 
tion functions including the RSSAS. The probability of individual function 
loss will be shown for various mission lengths assuming a fully operative 
system at dispatch and then again for a minimum equipment dispatch.. Compli- 
ance with safety criteria established in Paragraph 4.1.5 will be verified. 
Finally, the reliability of the total EET flight control system including 
integrated flight augmentation functions and two versions of the flight guid- 
ance system to be defined, is compared with the DC-10 reliability criteria of 
Paragraph 4.1.3. 

4.2.1 Definition of the EET Augmentation System 

4. 2. 1.1 Selected RSSAS Architecture. - Two candidate RSSAS architectures 
were selected as a result of the evaluation studies described in Section 6. 
They differ only in the redundancy of the Flight Augmentation Computer (FAC), 
one using three computers and the other only two. The triple redundant FAC 
configuration is shown in Figure 4-9. The dual configuration would eliminate 



SHOWN, FOR DUAL-REDUNDANT 
SYSTEM, REMOVE FAC 3 AND 
REWIRE AS DASHED LINES 
INDICATE. 


FIGURE 4-9. SELECTED RSSAS BLOCK DIAGRAM 
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the No. 3 FAC and rewire the elevator interface so that both inboard elevators 
received an input from both FACs. 

The required sensor array is based upon the selection of the control law 
family. Pitch attitude ( 0 ) is provided the the vertical gyros, pitch rate 
( 0 ) is obtained by differentiating the pitch signal, airspeed (u) by the air 
data computer, and angle of attack (a) from the angle of attack sensors. 

4. 2. 1.2 Additional Augmentation Functions. - Additional augmentation 
functions were considered for integration into the FAC. These include yaw 
damping, elevator load feel programming, flap limiting, and stall warning. 

On the DC-10 these functions are spread out among several different computers 
as shown in Figure 4-10. Yaw damping is performed by the yaw computer which 
also provides the autoland flight guidance function of runway alignment and 
rollout guidance. Elevator load feel programming and flap limiting computa- 
tion is performed by two, dual ELF/FL computers. The two Autothrottle/Speed 
Control (AT/SC) computers provide the stall warning calculations. 

Figure 4-11 shows the integrated triple redundant flight augmentation 
system proposed for the EET. This configuration is expanded in Figure 4-12 to 
identify the individual elements to be considered in this reliability analysis. 

4. 2. 1.3 Flight Guidance Systems. - The automatic flight control functions 
on the DC-10 are performed by a large complement of computers as shown in Fig- 
ure 4-13. These computers are all analog and represent the state-of-the-art 
technology for the time period in which the system was designed. For the EET, 
digital technology will be used to integrate and perform these automatic 
control functions. As shown in Figure 4-14, two digital Flight Control Com- 
puters will replace the 10 analog computers required for the DC-10. 

Reliability comparisons of the EET flight control system with that of the 
DC-10 baseline will consider: 

(a) An EET with a DC-10 type automatic flight guidance system to estab- 
lish the individual effect of the revised flight augmentation 
functions, and 

(b) An EET with a new digital automatic flight control system to evalu- 
ate the actual expect configurations. 
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S = SERIES 
INPUT 

‘CENTRAL AIR DATA COMPUTER 


FIGURE 4-10. DC-10 FLIGHT AUGMENTATION SYSTEM BLOCK DIAGRAM 


4. 2. 1.4 Failure Rate Data For Selected Systems. — To enable a quantita- 
tive reliability analysis of the selected configurations, failure rates are 
required at the appropriate level to be used in a math model of the system. 
Table 4-2 summarizes the failure fates derived for the 34 identified elements 
included in the analyses discussed in the next section. With the exception of 
the computer, the values were taken from current operational aircraft experi- 
ence or were adjusted for changes at the element or piece-part level where 
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S - SERIES 
INPUT 


•CENTRAL AIR DATA COMPUTERS 


FIGURE 4-11. EET FLIGHT AUGMENTATION SYSTEM BLOCK DIAGRAM 

design changes were deemed necessary for the RSSAS function or because the new 
computer performs the function differently from current systems. 


The computer failure rates are derived from a study of digital systems 
currently under development such as the DC-9 Super 80 autopilot, and design 
level estimates provided by vendors based largely on generic sources such as 
MIL-STD-217B. Two sets of failure rates were used for the SCDP and CPU to 
account for performing only the RSSAS function or to incorporate all the other 
functions also. The analyses considered both cases. 
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FIGURE 4-12. DETAILED INTEGRATED FLIGHT AUGMENTATION BLOCK DIAGRAM 





















FIGURE 4-13. DC-10 AUTOMATIC FLIGHT CONTROL SYSTEM BLOCK DIAGRAM 



































TABLE 4-2 

FAILURE RATES FOR SELECTED SYSTEM ELEMENTS 


■ 

ANALYSIS 

CODE 

NUMBER 

NAME 

FAILURE 
RATE IN 
FAILURES/HR 

FAILURE 

RATE 

SOURCE 

XI, X2, X3 

VERTICAL GYROS 


510 x 10~€ 

CURRENT AIRCRAFT 

X4, X5 

AOA SENSORS 


330 x 10-6 

CURRENT AIRCRAFT 

X6, X7 

AIR DATA COMPUTER 


100 x 10-6 

IMPROVED DC-10 TYPE 

X8, X9 

YAW RATE GYRO 


86 x 10-6 

CURRENT AIRCRAFT 

X10, XII 

FLAP-POSITION SENSING 


2 x 10-6 

DERIVED FROM DC-10 ELEMENTS 

X12.X13 

SLAT-POSITION SENSING 


61 x 10-6 

DERIVED FROM DC-10 ELEMENTS 

XI 4, X15, X16 

SCDP WITH ALL FUNCTIONS 

80 x 10—6 



Y14, Y15, Y16 

SCDP FOR RSSAS ONLY 


62.5 x 10-6 

► 

GENERICALLY DERIVED 

X17, X18, X19 

CPU WITH ALL FUNCTIONS 

260 x 10-6 


FROM STUDIES AND 

Y17, Y18, Y19 

CPU FOR RSSAS ONLY 


188 x 10—6 _ 


SYSTEMS UNDER DEVELOPMENT 

X20 

STICK SHAKER 


2.4 x 10—6 

DERIVED FROM DC-10 ELEMENTS 

X21, X22 

RUDDER ACTUATION 


5 x 10—6 

MODIFIED DC-10 

X23, X24 

ELEVATOR ACTUATION 


5 x 10“ 6 

MODIFIED DC-10 

X25, X26 

ELEVATOR-LOAD FEEL 


35 x 10-6 

DERIVED FROM DC-10 ELEMENTS 

X27, X28 

FLAP-LIMITING 


35 x 10-6 

DERIVED FROM DC-10 ELEMENTS 

X29, X30, 

JeHV, MOD, LVDT, 



DERIVED FROM DC-10 AND 

X31 , X32 

JAND VALVES COMBINED 


9 x 10—6 

VENDOR'S DESIGN DATA 

X33, X34 

INFLIGHT HYDRAULIC S' 

/STEM LOSS 

15 x 10-6 

CURRENT AIRCRAFT 
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4.2.2 Reliability Analysis 


4. 2. 2.1 Program Description. - The Network Reliability Analysis Model 
(RAM) is a computer program designed to calculate the reliability of complex 
systems. The program, written in Fortran IV for the IBM 370 computer, is 
capable of analyzing any system that can be described by a reliability logic 
diagram. 

The inputs required to run the program include: 

(a) Mission time (and total exposure time, if different) 

(b) Component failure rates 

(c) System success criteria. 

With this information RAM systematically "fails" different combinations 
of components, utilizing the success criteria to determine which combinations 
cause system failure. The probability of each such combination is then 
computed (using the product rule for independent events) and these are added 
together to produce the total probability of system failure. To ensure that 
the calculations are "mutually exclusive and exhaustive" a binomial expansion 
method is used. That is, the model first examines all "one failure" combina- 
tions, then all combinations of exactly two component failures, and so on until 
all probable combinations have been examined. A simplified flow chart of RAM 
is given in Figure 4-15. 

The success criteria are entered by means of logic equations. The use 
of this method is best explained by giving some examples. 

Table 4-3 shows some typical system networks and the logic equations that 
describe the successful operation of the networks. An "and" condition is 
symbolized by the character "*" and an "or" condition by the symbol "+." 

RAM is capable of analyzing one or several systems or system functions 
during the same run by entering a set of logic equations for each system func- 
tion to be analyzed. This feature is of value in evaluating alternative 
systems and determining the effect of varying component failure rates. 
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FIGURE 4-15. RAM FLOWCHART 
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TABLE 4-3 

EXAMPLES OF RAM LOGIC EQUATIONS 


LOGIC DIAGRAM 



LOGIC EQUATION 


S = A » B * C 


ENGLISH EQUIVALENT 


THE SYSTEM (S) WORKS IF A AND 
B AND C WORK 


(SERIES) 



= A + B + C 


THE SYSTEM(S) WORKS IF A OR B OR 
C WORKS 


(PARALLEL) 



f 


■ 

■ 

c 


-0 


= A • (B + C) + (B ♦ C) 


THE SYSTEM(S) WORKS IF A WORKS 
AND EITHER B OR C WORKS, OR 
BOTH B AND C WORK 


(TWO OF THREE REQUIRED) 



S 


C * (A + B) * (D + E) + THE SYSTEM(S) WORKS IF THE CROSSTIE (C) 
(A * D) + (B * E) WORKS AND EITHER A OR B WORKS AND 

EITHER D OR E WORKS, OR (IN CASE 
C FAILS) EITHER A AND D MUST 
WORK OR B AND E MUST WORK 


(CROSSTIE) 


The output from the model includes a listing of the components with their 
associated failure rates, and the probability of failure for each function 
requested. Appendix 5 provides these for some of the runs conducted in this 
study. 


4. 2. 2. 2 Reliability Logic Diagrams. - The reliability logic diagrams in 
Figures 4-16 through 4-19 are for the triple- and dual -redundant architectures 
discussed in Paragraph 4.2.1. The numbers in the blocks correspond to the 
elements listed in Table 4-2. 
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!~2 0F 3 REQUIRED] 



RAM ANSWER CODE 

A COMPUTERS PROVIDE RSSAS FUNCTIONS ONLY 
AA COMPUTERS PROVIDE ADDITIONAL FUNCTIONS ALSO 


FIGURE 4-16. RELIABILITY LOGIC DIAGRAM FOR RSSAS TRIPLE-REDUNDANT COMPUTERS 

Reliability logic diagrams are used to provide visual insight into the 
mathematical calculations performed by RAM. They illustrate the various paths 
available for successful performance of the function of interest as determined 
by the system architecture. In this sense they are usually clearer and less 
ambiguous than system schematics. 

Each function of interest is diagramed separately although many elements 
are common to several functions. Wherever the same number appears in more 
than one block it represents the same physical element, not another like it. 
When identical elements are physically duplicated each is uniquely identified 
as indicated in Table 4-2. Thus, if an element bearing a particular identifi- 
cation number fails, that failure affects every location where that number is 
used. The RAM answer code is merely to aid correlating the computer printouts 
provided in Appendix 5 to the proper logic diagrams. 

4. 2. 2. 3 Functional Reliability Calculations. — The logic equations for 
each of the diagramed functions were entered in RAM as previously discussed. 
Failure rates from Table 4-2 were used and probability calculations were made 
for exposure times of one, two, and five hours for each of the configurations. 
Complete computer printouts for these runs are provided in Appendix 5. 
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RAM ANSWER CODE 

A COMPUTERS PROVIDE RSSAS FUNCTIONS ONLY 
AA COMPUTERS PROVIDE ADDITIONAL FUNCTIONS ALSO 


FIGURE 4-18. RELIABILITY LOGIC DIAGRAM FOR RSSAS DUAL-REDUNDANT COMPUTERS 


Additionally, calculations were made for a postulated worst case minimum 
equipment dispatch. The aircraft was presumed to depart with all of the items 
listed below inoperative at the start of the flight. 

One of three vertical gyros 

One of two angle-of-attack sensors 

One of two yaw rate gyros 

One of two flap position monitors 

One of two slat position monitors 

One of three computers (SCDP and CPU) 

One of two rudder actuators 
One of two ELF actuators 

Table 4-4 is a tabulation of some of the results of these analyses. Fig- 
ure 4-20 is a plot of the RSSAS function failure probability versus exposure 
time. It illustrates the sensitivity of the configurations considered in this 
study to the one-hour standard discussed in Paragraph 4.1.4. Even for the 
worst case minimum equipment dispatch, the goal of 1x10 5 failure probability 
is not exceeded. 


83 




















RAM 



YAW DAMPER 



STALL WARNING 



ELEVATOR LOAD FEEL 



FLAP-LIMITING 


FIGURE 4-19. RELIABILITY LOGIC DIAGRAMS FOR NOTED FUNCTIONS - DUAL-REDUNDANT 
COMPUTERS 


A further analysis was conducted to determine the reliability sensitivity 
of the functions with a single-selected element inoperative at dispatch. Tables 
4-5 and 4-6 show the results of this analysis in terms of a multiplier to the 
loss probabilities calculated for "all up" dispatches shown in Table 4-4. 

Finally, an analysis of the impact on dispatch delays and economic relia- 
bility was conducted. Two possibilities were considered. First, that RSSAS 
would be added but the baseline DC-10 flight guidance system would remain. 
Second, the new computers would integrate both RSSAS and FGS functions. The 
basis for this analysis is the components listed in Appendix 3. Those compo- 
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TABLE 4-4 

PROBABILITY OF FUNCTION LOSS 
DURING ONE-, TWO-, AND FIVE-HOUR EXPOSURES 



3-COMP CONFIGURATION 

2-COMP CONFIGURATION 

RAM 

CODE 

FUNCTION 

1 HR 

2 HR 

5 HR 

1 HR 

MIN DISP 

1 HR 

2 HR 

5 HR 

A 

RSSAS (ONLY) 

0.259 x 10 -9 

1.07 x 10 -9 

7.37 x 10 -9 

255 x 10 -9 

41.4 x 10 -9 

166 x 10 -9 

1030 x 10 -9 

AA 

RSSAS (ALL FUNCTIONS) 

0.272 x 10~ 9 

1.18 x 10 -9 

8.98 x 10 -9 

294 x 10” 9 

76.8 x 10 -9 

307 x 10 -9 

1920 x 10 -9 

B 

YAW DAMPER 

0.858 x 10 -7 

3.43 x 10 -7 

21.4 x 10~ 7 

3660 x 10“ 7 

0.922 x 10 -7 

3.69 x 1 0 — 7 

23 x 10~ 7 

C 

STALL WARNING 

0.258 x 1 0~ 5 

0.552 x 10“ 5 

1 .65 x 1 0~ 5 

39.5 x 10 -5 

0.259 x 10 -5 

0.555 x 10 -5 

1.67 x 10 -5 

D 

ELF 

0.970 x 10 -7 

3.88 x 10 -7 

24.2 x 10 -7 

2950 x 10 -7 

1.03 x 10 -7 

4.14 x 10 — 7 

25.8 x 10 -7 

E 

FLAP LIMITING - 

0.970 x 10 -7 

3.88 x 10~ 7 

24.2 x 10 -7 

2950 x 10 -7 

1.03 x 10“ 7 

4.14 x 10~ 7 

25.8 x 10 -7 

ALU 

ALL FUNCTIONS 

0.018 xIO -9 

0.144 x 10~ 9 

2.22 x 10 -9 

74 x 10 -9 

74 x 10 -9 

296 x 10 -9 

1850 x 10 -9 

AAB 

RSSAS AND YAW DAMPER 

0.245 x 10 -9 

1.06 x 10 -9 

8.10 x 10 -9 

85.9 x 10 -9 

74.2 x 10 -9 

297 x 10 -9 

1860 x 10” 9 



PROBABILITY OF FUNCTION LOSS 


1 x 10' 


1 x 10 


1 x 10 


1 x 10 


1 x 10 


1 x 10 



FIGURE 4-20. RSSAS FAILURE PROBABILITY VERSUS EXPOSURE TIME 
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TABLE 4-5 

EFFECT OF VARIOUS SINGLE COMPONENTS INOPERATIVE - 
3-COMPUTER CONFIGURATION 


SINGLE-COMPONENT 
TYPE INOPERATIVE 

INFLIGHT FAILURE PROBABILITY IMPACT ON: 

ONLY 
RSSAS (A) 

YAW DAMPER (B) 

STALL WARN (C) 

ELF (D) 

FL (E) 

VERTICAL GYRO 

INSIG 

NONE 

NONE 

NONE 

NONE 

A OF A 

INSIG 

NONE 

127 TIMES WORSE 

NONE 

NONE 

AIR DATA COMPUTER 

INSIG 

NONE 

NONE 

1030 TIMES WORSE 

1030 TIMES WORSE 

YAW RATE GYRO 

NONE 

1000 TIMES WORSE 

NONE 

NONE 

NONE 

FLAP POSITION 

NONE 

NONE 

1.8 TIMES WORSE 

NONE 

NONE 

SLAT POSITION 

NONE 

NONE 

24 TIMES WORSE 

NONE 

NONE 

SC DP AND CPU (1 OR 3) 

173 TIMES WORSE 

3255 TIMES WORSE 

100 TIMES WORSE 

3093 TIMES WORSE 

3093 TIMES WORSE 

SCDP AND CPU (2) 

158 TIMES WORSE 

INSIG 

INSIG 

INSIG 

INSIG 

STICK SHAKER 

NONE 

NONE 

CRITICAL 

NONE 

NONE 

RUDDER ACTUATION 

NONE 

3255 TIMES WORSE 

NONE 

NONE 

NONE 

ELEVATOR ACTUATION 

20,000 TIMES WORSE 

NONE 

NONE 

NONE 

NONE 

ELEVATOR LOAD FEEL ACTUATION 

NONE 

NONE 

NONE 

3093 TIMES WORSE 

NONE 

FLAP LIMITER ACTUATION 

NONE 

NONE 

NONE 

NONE 

3093 TIMES WORSE 

EHV, MOD. LVDT AND SOV (COMP 2) 

16 TIMES WORSE 

NONE 

NONE 

NONE 

NONE 

HYDRAULIC SYSTEM 

60,000 TIMES WORSE 

3255 TIMES WORSE 

NONE 

NONE 

NONE 

EHV, MOD. LVDT AND SOV 
(COMP 1 OR 3) 

157 TIMES WORSE 

NONE 

NONE 

NONE 

NONE 


THIS TABLE I LLUSTRATES THE FAILURE PROBABILITY SENSITIVITY OF FUNCTIONS WITH SELECTED COMPONENTS INOPERATIVE 
FOR THE TOTAL FLIGHT. IT REFLECTS THE RELATIVE IMPORTANCE OF THESE COMPONENTS TO THE FUNCTIONAL CONFIGURATIONS 
ANALYZED. IT SHOULD NOT BE CONSTRUED TO ENDORSE ANY SPECIFIC DISPATCH-INOPERATIVE CRITERIA. 












































TABLE 4-6 

EFFECT OF VARIOUS SINGLE COMPONENTS INOPERATIVE - 
2-COMPUTER CONFIGURATION 


SINGLE-COMPONENT 
TYPE INOPERATIVE 

INFLIGHT FAILURE PROBABILITY IMPACT ON: 

RSSAS (A) 

YAW DAMPER (B) 

STALL WARN (C) 

ELF (D) 

FL (E) 

VERTICAL GYRO 

INSIG 

NONE 

NONE 

NONE 

NONE 

A OF A 

INSIG 

NONE 

127 TIMES WORSE 

NONE 

NONE 

AIR DATA COMPUTER 

INSIG 

NONE 

NONE 

1000 TIMES WORSE 

1000 TIMES WORSE 

YAW RATE GYRO 

NONE 

934 TIMES WORSE 

NONE 

NONE 

NONE 

FLAP POSITION 

NONE 

NONE 

1.7 TIMES WORSE 

NONE 

NONE 

SLAT POSITION 

NONE 

NONE 

24 TIMES WORSE 

NONE 

NONE 

SCDP AND DPU 

6038 TIMES WORSE 

391 3 TIMES WORSE 

130 TIMES WORSE 

3800 TIMES WORSE 

3800 TIMES WORSE 

STICKSHAKER 

NONE 

NONE 

CRITICAL 

NONE 

NONE 

RUDDER ACTUATION 

NONE 

3043 TIMES WORSE 

NONE 

NONE 

NONE 

ELEVATOR ACTUATION 

120 TIMES WORSE 

NONE 

NONE 

NONE 

NONE 

ELEVATOR LOAD FEEL ACTUATION 

NONE 

NONE 

NONE 

3000 TIMES WORSE 

NONE. 

FLAP LIMITER ACTUATION 

NONE 

NONE 

NONE 

NONE 

3000 TIMES WORSE 

EHV, MOD, LVDT AND SOV 

INSIG 

NONE 

NONE 

NONE 

NONE 

HYDRAULIC SYSTEM 

362 TIMES WORSE 

3043 TIMES WORSE 

NONE 

NONE 

NONE 


THIS TABLE I LLUSTRATES THE FAILURE PROBABILITY SENSITIVITY OF FUNCTIONS WITH SELECTED COMPONENTS INOPERATIVE 
FOR THE TOTAL FLIGHT. IT REFLECTS THE RELATIVE IMPORTANCE OF THESE COMPONENTS TO THE FUNCTIONAL CONFIGURATIONS 
ANALYZED. IT SHOULD NOT BE CONSTRUED TO ENDORSE ANY SPECIFIC DISPATCH-INOPERATIVE CRITERIA. 




nents that are replaced by new items were deleted and replaced by the appro- 
priate items from Table 4-2. The net difference was then calculated by com- 
paring item by item the cause for each delay in the baseline sample of 660 
occurrences discussed in Paragraph 4. 1.3.1, and adjusting the overall probabil- 
ities by the relative reliability of the old and new elements. Two computers 
were assumed required for dispatch in all four cases analyzed. 

A similar approach was used to estimate the net effect on economic relia- 
bility in terms of MTBUR. The components replaced from the list in Appendix 3 
by new elements had their contribution to the MTBUR subtracted out. The fail- 
ure rates of the selected new items from Table 4-2 were increased by 20 percent 
to allow for less than perfect troubleshooting at the line level and factored 
into the remaining list to calculate the new total MTBUR for each configura- 
tion. The results of the delay analysis and the MTBUR analysis are given on 
Table 4-7. 

TABLE 4-7 

RESULTS OF DISPATCH DELAY AND 
ECONOMIC RELIABILITY ANALYSES 




♦RSSAS ADDED 

* RSSAS ADDED 

♦RSSAS AND NEW FGS 
FUNCTION ADDED 

EVENT 

BASE DC-10 

3-COMP CONF 

2-COMP CONF 

3-COMP CONF 


DELAYS 






0-15 MIN 

0.73 x 10~ 3 

0.66 x 10 -3 

0.89 x 10 -3 

0.57 x 10 -3 

0.76 x 10~ 3 

> 15 MIN 

2.11 x 10~ 3 

1.99 x 10 -3 

2.38 x 10 -3 

1.73 x 10 -3 

2.18 x 10~ 3 

CANCELLATIONS 

ABORTS 

0.12 x 10 -3 
0.05 x 10 -3 ** 

0.11 x 10 -3 

0.14 x 10~ 3 

0.11 x 10 -3 

0.13 x 10 -3 





OUT OF SERVICE 

0.02 x 10 -3 

0.02 x 10~ 3 

0.02 x 1 0 — 3 

0.02 x 10~ 3 

0.03 x 10~ 3 

TOTAL 

3.03 x 10 -3 

2.79 x 10 -3 

3.43 x 10~ 3 

2.43 x 10~ 3 

3.10 x 10 -3 

♦VALUES BASED ON X -HOUR FLIGHT; NO CREDIT FOR GROUND REPAIR TIME; TWO COMPUTERS REQUIRED 
FOR DISPATCH. 

♦♦PILOT ELECTIVE ABORTS, NO CR 

ITICAL FUNCTIONS LOST. 



MTBUR 

(STUDY GOAL) 
70 HOURS 

76 HOURS 

78 HOURS 

116 HOURS 

122 HOURS 
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SECTION 5 

CONTROL LAW DEVELOPMENT 


The aerodynamic performance of the EET aircraft requires two unique 
control functions: relaxed longitudinal static stability augmentation, and 

compensation for pitch coupling to variations in engine thrust. The primary 
objective of this study is the development of a longitudinal control system 
to restore the classic commercial transport flying qualities to an aircraft 
with approximately zero static margin. The system referred to as the Relaxed 
Static Stability Augmentation System (RSSAS) must perform this task by sensing 
the primary control inputs and aircraft response and providing supplementary 
aircraft control commands. Since the EET is a derivative of the DC-10 with 
anticipated common airline operators, commonality of hardware, function, and 
flying qualities are goals of the aircraft system design. Specifically, the 
RSSAS control law development has been based upon (1) use of the sensor types 
presently available on the DC-10, and (2) duplication of the DC-10 flying 
qualities with regard to aircraft response to pilot control inputs. RSSAS 
aircraft control is accomplished primarily through the elevator surfaces. 
Control laws have also been developed for joint elevator and throttle control, 
but the added complexity of an automatic throttle augmentor will not be 
permitted, since elevator-only control has been successfully demonstrated. 

The basic EET exhibits significant pitching moments due to thrust changes 
on the wing-mounted engines. While this characteristic is not a result of 
relaxed stability, it has a degrading effect on both the aircraft static 
stability and the pilots ability to stabilize the aircraft velocity. The 
augmentor has been developed also to provide the necessary elevator control 
to compensate for this pitch- thrust coupling. Two methods were identified 
as solutions. The first was to develop relaxed stability augmentation control 
laws with integral thrust-sensing and automatic throttle control. This would 
have a significant impact on the required system components, interfaces, and 
total functional availability. The second approach (which was followed) 
assumed that a simple thrust-to-elevator compensation could be determined 
for all control laws and flight conditions. This control is functionally 
independent of the relaxed static stability augmentation. 
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It is very important that large displacement or long-term elevator 
deflections be transferred to the horizontal stabilizer to restore the 
elevator authority and trim. The existing DC-10 type horizontal stabilizer 
trim system has been modified to provide this feature and the autotrim mechani- 
zation is discussed in detail in Section 6 of this report. 

5.1 Modern Control Theory Technique 

5.1.1 General Discussion. - The modern control analysis and simulation 
program J8QN, previously developed at Douglas, has been used to generate 
full -state feedback RSSAS control laws based upon EET equations of motion for 
six flight conditions. These control laws were developed using an implicit- 
model -foil owing technique (Reference 8) in which selected feedforward and 
feedback gains cause the aircraft to follow a specified model as closely as 
possible. Figure 5-1 is an example of this model -foil owing technique. In 
this example, the aircraft equations are for the cruise aft center of gravity 
with the EET (40 percent mean aerodynamic chord (MAC)), and the model equa- 
tions are the aft center of gravity DC-10 (30.3 percent MAC). The gain 

# 

matrix, M, is the resultant required gains for u,a,e, and e for the elevator 
and throttle controls. The F matrix is the required gains for elevator and 
throttle commands. 

5.1.2 Optimization Constraints. — Results obtained from this implicit- 
model -foil owing synthesis method depend heavily upon the designer-selected 
weighting factor matrices, Q and R. Past experience with the method has 
shown that the best model -foil owing is obtained when R is taken as a null 
matrix. Selecting R to be null could, in principle, lead to excessively high 
gain matrices. This possible problem can always be avoided in practice by 
realistic model selection. No problems of this sort have been encountered 

in the EET studies. Past experience has also shown that choosing Q to be 
simply a diagonal matrix, as is usually done in application of theory, leads 
to a matching of the high-frequency response of the model. This choice can 
result in totally unacceptable low-frequency-matching in some cases. A 
method was previously developed at Douglas which automatically selects the 
weighting matrix Q so that all frequencies are reasonably matched. This is 
done when equating the aircraft and model by multiplying by the inverse 
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AIRCRAFT EQUATIONS 


MODEL EQUATIONS 



FEEDBACK 
GAIN MATRIX 


X = AX + BU 


X = LX + N6 
m m 


COST FUNCTION MINIMIZED 


OO 

/ t(X-X m ) t Q(X-X m ) + U t RU]dt 


vO 

OJ 


NUMERICAL EXAMPLE 


-0.004 

0.006 

-0.0724 

-0.0412 


0.004 

0.1298 

-0.247 

-0.494 

0.986 

-0.003 


B = 

-0.049 

-0.003 

2.031 

-0.64 

-0.646 

0.0 


-3.925 

1.142 

0.0 

0.0 

1.0 

0.0 

* 


0.0 

0.0 

-0.008 

0.029 

-0.024 

-0.040 



0.001 

0.287' 

-0.105 

-0.607 

0.973 

-0.001 


N = 

-0.053 

-0.006 

-0.051 

-1.412 

-0.723 

-0.001 


-2.387 

0.0 

0.0 

0.0 

1.0 

0.0 



0.0 

0.0 



VELOCITY ERROR 
ANGLE OF ATTACK 
PITCH RATE 
PITCH ATTITUDE 


[ <5 e 1 ELEVATOR DEFLECTION 
8 t J THROTTLE DEFLECTION 

[ 5 e 1 ELEVATOR COMMAND 
8 t ] THROTTLE COMMAND 


f 0.075 

0.306 

-0.025 

0.129 

p _f 0.767 

0.66 

[-0.919 

-0.022 

0.091 

0.020 

[ 0.408 

2.123 


FIGURE 5-1. IMPLICIT-MODEL-FOLLOWING CONTROL 





of L [(L)’^]. In practice, this is done by setting Q = (L L T )“^ (|L|L T ) 
Modern control analysis program J8QN has incorporated these weighting factor 
selection features. Thus, in the present synthesis studies, the full -state 
feedback solutions were determined uniquely in terms of the aircraft equations 
of motion and the desired model equations. This method has proved to be 
highly successful in producing high-quality solutions for all frequencies. 

5.1.3 Real -Model Following . - Although most of the EET control law 
synthesis studies performed have involved the implicit-model -foil owing 
approach, some preliminary work has been done using a new real -model -foil owing 
synthesis procedure. This real -model -foil owing approach, shown in Figure 5-2, 
first generates a full -state feedback gain matrix, M, by means of a Linear- 
Quadratic-Gaussian (LQG) regulation synthesis. The weighting factors, Q and 
R, are selected by the designer so that reasonable feedback gains and closed- 
loop natural frequencies are obtained. These gains will usually be higher 
than the gains generated by the implicit-model-following approach. The new 
features in this approach involve the subsequent determination of a compen- 
sator model and a feedforward gain matrix which cause the command response of 
the system to track the desired model response. The command response 
tracking of this system is similar to that of the system based on implicit- 
model -foil owing. Real -model -foil owing is suggested when a reduction is 
required in sensitivity of the response to changes or uncertainties in air- 
craft parameters. In the analysis performed to date, a need for this approach 
has not been demonstrated; therefore, work in this area has been discontinued. 
Subsequent studies based on flight data may result in a renewed interest in 
real -model -fol lowing. 


5.2 Control Law Formulation 

5.2.1 Full -State Control Law Development. — The implicit-model- 
following synthesis technique has been employed in the current EET studies to 
develop full -state feedback control laws for approach and cruise flight 
conditions. The aircraft equations of motion employed were EET linearized 
three-degrees-of-freedom longitudinal equations for center-of-gravity 
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AIRCRAFT EQUATIONS MODEL EQUATIONS 

X = AX + BU X = LX + N6 

m m 

CONTROL EQUATIONS COMPENSATOR EQUATIONS 

U = M(X — X ) + F6 X = CX + D6 

c c c 

COST FUNCTION MINIMIZED 

oo 

/ [X T QX + U T RU] dt 

O 

FIGURE 5-2. REAL-MODEL-FOLLOWING CONTROL 

locations at 40- and 50-percent aft mean aerodynamic chord described with data 
established November 1977. The model equations employed were the DC-10 
equations for comparable flight conditions, except that a center-of-gravity 
location of 30-percent MAC was used in all cases. Various configurations 
were investigated for elevator and throttle commands. Satisfactory model - 
tracking for elevator commands was obtained, using only elevator surface 
control. It was necessary to introduce a crosstie between thrust and elevator 
to obtain acceptable throttle command model-tracking. Thus, implicit-model- 
following synthesis cases were run for elevator-only control, and elevator and 
throttle command and control. The latter cases produced full-state feedbacks 
to both elevator and throttle as well as a complete command crosscoupling 
feedforward matrix. 

5.2.2 Reduced States Control Law Development. - State-transformation 
and transfer-function-generating techniques previously developed at Douglas 
were employed to generate alternative control laws with many different sensor 
arrays for several approach and cruise flight conditions. These control laws 
were based upon the corresponding full-state implicit-model-following 
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synthesis. It will be shown later in this report that these control laws 
produce approximately the same aircraft command response. A total of 32 
sensor combinations have been considered (see Table 5-1). Most of these 
have yielded acceptable control laws. 

In the initial control law development phase, a transfer- function- 
generating technique was used which expressed the elevator and throttle 
commands in terms of transfer functions that shape the state feedbacks and 
pilot commands. Fewer feedbacks were required than for full -state feedback; 
thus, sensor configuration simplification occurred at the expense of filter 
complexity. Quite often the filters generated by the theory were reduced by 
pole-zero cancellation, and the resulting configurations were somewhat 
simpler than the original full -state feedbacks. A block diagram of an 
initial angle-of-attack control law (Law No. 5) is shown in Figure 5-3 for 
the approach and cruise cases. An acceptable thrust crossfeed was not 
obtained for the cruise cases. Block diagrams for all of these initial 
control laws, excluding those containing longitudinal acceleration, are 
presented in Appendix 6. 


TABLE 5-1 
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«e 

(RAD) 


K 1 = 0.6457 
K 2 = 0.3816 
Kg = 0.20 
= 0.0356 
K 5 = 0.000318 


K. = 0.07758 
K® = 0.0227 
Kg = 1.385 
Kg = 1.80 
K^ = 0.0478 


CRUISE 


K n = -0.0008052 
= 0.07758 
K^g = 0.0227 
K^ = 0.0024 
K^g = 50.0 


K 1 = 0.51035 
K 2 = 0.1195 
Kg = 0.0 
K^ = 0.05 
Kg = 0.03338 


Kg = 0.02 

K° = 0.004709 
Kg = 1.138 
K g =. 1.64 
K 10 = -.0.2198 


'11 

C 12 

S 13 

14 

^15 


= -0.02793 
= 0.02 
= 0.004709 
= 0.0 
= 50.0 


FIGURE 5-3. CONTROL LAW NO. 5 (a) 


Two problems that occurred with the transfer-function method are: 

(1) the generation of control laws that lead to unstable closed-loop poles 
which are cancelled by unstable zeros in the feedforward transfer function, 
and (2) the generation of control -transfer functions with unstable poles. 

The command responses still match that of the full -state configuration from 
which these transfer- function forms were derived, but these unstable configur- 
ations cannot be employed in a practical control system. 

5.2.3 . Elimination of Several Initial Control Laws. — Prior to solving 
the unstable pole problem, the number of control laws being investigated was 
reduced. Based on simulation studies, all control laws involving longitudinal 
acceleration (Ax) were eliminated. The Ax control laws provided acceptable 
response to elevator inputs but quite unacceptable response for throttle 
inputs. The throttle response could be made acceptable but required high- 
gain crossfeeds with destabilizing signs- (i.e., positive feedback). With the 
number of acceptable control laws not requiring this high -gain crossfeed, no 
system degradation was obtained by the elimination of the Ax sensor. Control 
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laws containing altitude rate (h) were eliminated, based on the statistical 
evaluation of the control law performance in turbulence which will be dis- 
cussed later in Paragraph 5.5.1. Two control laws, 27 and 28, utilizing 
pitch rate but not pitch, were eliminated due to similarity of sensor source 
with control laws 3 and 4. Finally, control laws 13 and 32 were eliminated 
by the configuration studies reported in Section 6 of this report, since the 
selected sensor sets did not provide these combinations of sensors in the 
failure-reversion paths. 

5.2.4 Pole Placement Synthesis. - With the number of control laws 
reduced from 32 to 11, an attempt was made to eliminate the unstable ele- 
ments of the control laws. The transfer-function forms required placement 
of the shaping network closed-loop poles and also placement of open-loop 
transfer-function poles. All control laws were stabilized by performing 

a multiple-pole placement synthesis in which both sets of poles were 
simultaneously moved to new locations. While this method was able to 
eliminate the unstable elements, it did not have enough independent physical 
parameters which could be varied so that all poles could be place at will. 

Two sets of perturbation equations (cruise and approach) were used to develop 
the control laws with this new technique and when the same control law forms 
were compared for the two flight conditions, it was noted that the filters 
were radically different. The combined filters were the same order, but the 
individual components were different. A third-order filter for approach 
might consist of a second-order and a first-order while the same law for cruise 
would be three first-order filters. Simplification and approximations for 
the filters was attempted, to determine if the control law would perform 
satisfactorily over the flight envelope. Of the eleven control laws, three 
were acceptable over the flight regime. Two of these were full state control 
laws (e, 6 , u, a, and 0, e, u, a n ) requiring no filters and the other 
(0 0 u), by coincidence, had the same filter for the two flight conditions. 

Unfortunately, the pole-placement synthesis could not place the poles in 
the same location for the two flight conditions. 

5.2.5 State Space Form . — It was assumed at the beginning of the control 
law development that when transfer functions are used, it is undesirable to 
have the surface control fed back to the observer, as Luenberg's form requires 
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(Reference 8). This is due to noise generally present on the position feed- 
back, as well as the consideration that a single computation may drive more 
than one surface and thus require some type of signal -averaging before use 
in the observer. The disadvantage of this form, however, is that the 
observer poles are distinct from the extra closed-loop poles, due to the 
observer. A re-examination of the control laws showed that the transfer 
function method expressed in state space form was closely related to 
Luenberger's reduced-order observer. A control form was then adopted which 
essentially replaced the requirement for surface-position feedback, with the 
control command fed back to the observer. This is a simple mechanization, 
since the control command is singular and totally contained within the RSSAS 
computer. Having adopted this form, the closed-loop poles added by the 
observer are the same as the observer poles. This new form requires only a 
single pole placement, and there are enough free parameters to permit pole 
location of all observer poles to desired values. 

Since the control laws were now being developed in state space form 
rather than transfer functions, a reduction was also possible in the amount 
of computation required to implement the control laws. There was no reason 
that the observer had to generate physical states; therefore, much computation 
was eliminated by employing normal states instead of physical states. A 
computer program was then written which takes the basic Luenberger observer 
matrices, and a matrix which contains the observer pole placement synthesis 
transformation matrix, and generates all the elements needed for a difference- 
equation control law formulation. This program was used to generate control 
laws for nine configurations at both cruise and approach. The full -state 
feedback control laws are unaffected by the change of form. A block diagram 
of the control laws is shown in Figure 5-4, with the gains used for the angle- 
of-attack law given in Figure 5-5. Figure 5-4 applies for all control laws. 
Numbers for the remaining 10 control laws are given in Appendix 7. 

An advantage of the present control law formulation is that the feed- 
forward and throttle cross-tie blocks are the same for all nominally equiva- 
lent control laws. Also, in the state space form, the filters are not only 
the same throughout the flight envelope, but they are also the same from 
control law to control law. 
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PILOT 

COMMAND 


SENSORS 
(a, 6, u, a n > 
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THRUST 



ELEVATOR 

COMMAND 


FIGURE 5-4. RSSAS CONTROL LAW BLOCK DIAGRAM 


PX1 = EXP (-10.0 * DT) 
PX2 = EXP (-0.8 * DT) 
PX3 = EXP (-0.25 * DT) 
PX4 = EXP (-0.2 * DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * (1 - PX1) 

Z2 = Z2 * PX2 + (-10.8726 * U1 + 2.05745 * THRUST - 1.83644 * a) * (1 - PX2) 

Z3 = Z3 * PX3 + (-79.918 * U1 + 4.31615 * THRUST - 18.297 * a) * (1 - PX3) 

Z4 = Z4 * PX4 + (79.777 * U1 - 1.38494 * THRUST + 22.18449 * a) * (1 - PX4) 

U = 0.01501 * Z1 + 0.15802 * Z2 - 0.1778 * Z3 - 0.14585 * Z4 + 0.21952 * a + 0.29 * THRUST 
FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * <1 - PX1) 

7.1 = 7.2 * PX2 + (-7.4035 * U1 + 2.0827 * THRUST - 0.71526 » a) » (1 - PX2) 

Z3 = Z3 * PX3 + (-147.064 * U1 + 46.4056 * THRUST - 7.395 * a) * (1 - PX3) 

Z4 = Z4 * PX4 + (157.61 * U1 - 50.7887 * THRUST + 9.20378 * a) * (1 - PX4) 

U = 0.01519 * Z1 + 0.12673 * Z2 - 0.07174 * Z3 - 0.06469 * Z4 + 0.5598 . a + 0.31 * THRUST 

FEED FORWARD = 0.674 

FIGURE 5-5. EET CONTROL EQUATIONS - LAW NO. 5 
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5.2.6 Gain Programming . - With the control laws expressed in state space 
form, it becomes quite simple to write programs for the numbers as a function 
of velocity. However, each number in the matrix has to have its own program. 
Some of the gains increase with velocity, while others will decrease with 
increasing velocity. Also, the number of gain programs per control law 
varies. The full -state feedback requires only six gain programs, while the 
angle-of-attack control law requires seventeen. The gain programming 
schedules for control laws 1-7 are provided in Appendix 7. 

5.3 Simulation Configuration 

The RSSAS control law validation and performance analysis was conducted 
in the Douglas DETAC (Digital Equipment Technology Analysis Center). In this 
facility a simulation was developed to represent the aircraft, augmenter, 
and necessary interfacing systems. Both perturbation and LFE (large flight 
envelope) aircraft aerodynamics were used, depending upon the intent of the 
various RSSAS evaluations. 

5.3.1 Facility . — A digital computer simulation of the EET aircraft 
and augmentor was used to evaluate the dynamic performance of the system. 

The simulation was developed in FORTRAN IV, for the DETAC facility (Fig- 
ure 5-6). The facility consists of: 

• Central digital computer with a real-time operating system FORTRAN IV 
software package, 96K words of memory-mapping, cache, and floating- 
point hardware, plus three satellite computers, each with 32K words 
of memory, all connected by a high-speed communication link. 

• Three interactive graphics units, one with color displays. 

• Cockpit mockup. 

The relationships among the major elements of DETAC are shown in the 
block diagram of Figure 5-7. The Sperry Uni vac V76 minicomputer is general- 
purpose and microprogrammable. A cache enhances memory access for faster 
operation. Three Sperry Uni vac V73 minicomputers provide computations and 
simulation support for the central computer. Peripheral support equipment 
includes a DEC-writer III terminal, card reader, magnetic tape, cassette tape, 
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FIGURE 5-6. DETAC FACILITY 



FIGURE 5 7. DETAC HARDWARE BLOCK DIAGRAM 
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Century Data CDS-114 disc, Infotron Vistar/GT Alphanumeric display terminal, 
and Varian Statos-31 printer/plotter. 

The Vector General display system interacts in real time with the central 
computer. The graphic system has a hardware two-dimensional, rotatable- 
coordinate transformation generator driving two display stations, each with 
a 53-cm (21-inch) CRT, light pen, function-switch keyboard, and alphanumeric 
keyboard. The displays can be driven independently or in parallel. 

Equipment for interfacing with avionics devices includes analog-to- 
digital and digital-to-analog converters, digital-to-synchro converters, and 
digital input/output modules. 

5.3.2 Computer Setup . — The simulation is separated into three 
separate and distinct jobs: problem setup, execution, and analysis. The 

setup task consists of modifying the system gains, initial conditions, type 
of upsets, wind conditions, and other related items. Each of these inputs 

is easily modified by means of the light pen and alphanumeric keyboard at the 
graphics system. This program runs exclusively in the main machine. 

The simulation task is broken down into three subtasks. Each of these tasks 
is then solved in one of the three computers used and any data needed by the 
other machines are transferred via a high-speed data link. The machines run 
in an asynchronous mode with the data being transferred when available. The 
data from the other machines are buffered so all solutions are solved with 
data obtained at the same time. The main machine schedules the other two 
machines, but after that no machine is master. The main machine solves the 
display portion of the problem, samples autopilot and augmentor mode switch- 
ing, and transfers the time history data points from the other two computers 
to the disk storage device. The second computer solves the aircraft equations, 
generates sensor information, develops the environment, and solves the engine 
dynamics. The third computer interfaces with the pilot inputs, solves the 
autopilot, autothrottle, and augmentor equations, and simulates the actuator 
dynamics. The main computer completes its task 10 times per second while 
the other two machines run 20 times per second. Time-history data are 
stored twice per second. A flow chart of the simulation task is shown in 
Figure 5-8. 
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FIGURE 5-8: MULTICOMPUTER SIMULATION 























While the simulation task is being solved, time-history data are written to 
the disk. These data are sent to the disk as rapidly as possible in whatever 
order and form available. The first section of the analysis task reads the 
data into the computer to reorder and process the data for plotting purposes. 
The plot program allows the analyst great flexibility. He or she has the 
option of plotting any of 60 parameters with any of the remaining 59 from 
any of four cases. Up to two parameters can be plotted on the same curve 
with a maximum of six curves per page. If only a section of the curve is 
desired, a zoom feature is supplied. Hard copy of any desirable data, of 
report quality, is instantaneously available. Tabulation of the data is 
also available. 

5.3.3 System Descriptions 

5. 3. 3.1 Aircraft. - Two aircraft simulations were developed - a perturbation 
aircraft and a large-flight-envelope aircraft. The perturbation aircraft is 

simulated as two sets of three-degree-of-freedom equations with cross-coupling 
terms between the sets of equations. The longitudinal equations are based 
upon the aerodynamic description of the EET aircraft. The lateral equations 
are those of the DC- 10 Series 10 for a corresponding flight condition at a 30 
percent center-of-gravity case. The cross-coupling terms are those of the 
EET. The perturbation equations are valid for large pitch changes, but allow 
only small changes in airspeed and angle of attack. These equations utilize 
linear fixed coefficients for the aircraft description. The large-flight- 
envelope equations were the same equations used for the motion base studies. 
These equations allow for large airspeed and angle-of-attack variations, 
valid from takeoff to landing. 

5. 3. 3. 2 Sensors.- No system lags were simulated for the aircraft sensors. 
The sensors were located at the proper station number for the DC-10 aircraft. 
Gains other than unity could be introduced for the sensors used by the aug- 
mentor, but these gain-varied signals were not utilized by the autopilot or 
speed command system. Multiple sensors of the same signal were not simu- 
lated. 

5. 3. 3. 3 Engines. - Two engine simulations were developed — one for the 
perturbed aircraft equations and one for the large-flight-envelope equations. 
The engine for the perturbed aircraft was simulated as a first-order lag 
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(time constant of 0,5 seconds) and a fixed gradient (183.5 kilonewtons per 
radian of throttle). The maximum thrust is limited to 169 kilonewtons per 
engine while the minimum thrust is 6.2 kilonewtons per engine. The large- 
flight-envelope engine simulation is basically the same engine with the 
gradient, and limits a function of the aerodynamics. 

5. 3. 3. 4 Environment. — The wind model used for the turbulence is the 
standard Dryden wind model. In addition to turbulence, steady-state winds 
or winds as a function of altitude can be added in all axes. Even though 
the ILS beam signals are not used for the data runs discussed in this report, 
nonlinear centerline representations are available for several CAT I and 

CAT II airports. 

5. 3. 3. 5 Actuators. - The elevator actuators (four independent actuators) 
were simulated as a first-order lag (time constant of 0.1 seconds) with rate 
(1 radian per second) and position (0.44 radians) limits. At this stage of 
control law verification, the hysteresis and dead-zone characteristics have 
been eliminated. Also eliminated were the mechanical cross-ties between 
surfaces. The aileron actuators (two only) were simulated the same except 
with different rate (0.44 radians per second) and position (0.35 radians) 
limits. Only one rudder actuator was simulated with the same time-constant 
as the other actuator, but once again different rate (0.44 radians per 
second) and position (0.17 radians) limits. 

5.3.3. 6 Pilot Interface. — The pilot interface with the simulation is by 
one of two methods. Either the pilot can use the soft cockpit in the DETAC 
facility or he may use a small joystick. The graphics provides ADI-type 
information plus a plan view of aircraft path for pilot interface and the 
augmentor monitor. Both the joystick box and the cockpit provide for elevator 
and aileron inputs, flap movement, pilot trim switches, gear extension, and 
speed brake deployment. The pilot also has control of augmentor control law 
select, autopilot mode, speed control engage, and failure insertion by means 
of the control keys connected to the graphics system. Vertical speed knob 

of the autopilot vertical speed mode is simulated on the joystick box. 

5. 3.3. 7 Speed Control. — Automatic speed control is provided by means of a 
simulation of the standard DC-10 speed command system (see Figure 5-9). 
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FIGURE 5-9. EET SPEED COMMAND SYSTEM 

























No changes have been made to the system to make it compatible with the EET 
aircraft. An autothrottle servo is simulated for the system and no parallel 
input to the joystick or soft cockpit is provided (i.e., throttle levers do 
not move when automatic system is engaged). The automatic system can be 
engaged or disengaged at any time during the simulation run. 

5. 3. 3. 8 Autopilot. - The autopilot used for this study was an experimental 
system developed by Douglas IRAD for the DC-10. This autopilot is valid 
throughout the flight regime and includes such modes as pitch hold, vertical 
speed, altitude preselect, altitude hold, glideslope capture, glideslope 
track, flare, heading hold, heading select, localizer capture, localizer 
track, and align. 

5. 3. 3. 9 Augmentor. — During the development of the augmentor design, each 
version of the augmentor was simulated. The augmentor simulated now is the 
final version of the design described in Section 6 of this report. 

5.4 Control Law Verification 

All control laws formulated were initially verified in the DETAC where 
time histories of the aircraft response to elevator and thrust upsets were 
obtained, using the perturbation aerodynamic equations. The two upsets were 
an elevator pulse of 0.0175 radians (1°) for one second and a step thrust 
change of 6.3 kilonewtons (1430 lb). The time histories were obtained at both 
approach and cruise flight conditions. Each of the time histories was then 
compared with the responses of the DC-10 which was used as a model in the 
control law synthesis. Each control law response was also compared with 
every other control law. Although all 32 original and 11 final control laws 
were evaluated, only the seven control laws of eeua family (eeua,ee,eea,eeu, 
a , ya , y ) will be discussed in this section. 

Figures 5-10 through 5-13 provide an insight to the basic DC-10 and 
unaugmented EET airframe responses to the pitch and thrust upsets. The 25 
percent center-of-gravity EET is a mid center-of-gravity position and is 
statically stable while the 40 percent center-of-gravity EET is approximately 
at zero static margin. As shown, these configurations display significantly 
different characteristics for short-period damping, phugoid, and stability. 
Figure 5-14 provides a comparison of the DC-10 and augmented (eeua control 
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law) 40 percent center-of-gravity EET responses to the elevator upset for the 
cruise flight condition. These time histories for pitch and velocity are 
almost identical. It is these two parameters that the RSSAS attempts to 
match at the expense of a, since they are the physical characteristics that 
the flight crew observes. Comparisons of all seven control laws with the 
DC-10 for cruise and approach flight conditions are presented in Appendix 8. 
Figure 5-15 shows control law (eeua) to control law (eeu) tracking for this 
same upset. All control laws demonstrate this close comparison. 

The RSSAS without thrust- to-pitch compensation cannot provide the DC-10 
characteristics for the thrust upset. Figure 5-16 shows the two responses 
to be quite different. Adding the thrust/pitch compensation to the augmentor 
provides the satisfactory response shown in Figure 5-17. Comparisons of all 
seven control laws with the DC-10 for cruise and approach flight conditions 
have demonstrated this correlation. 

5.5 Performance Analyses 

Several analyses have been conducted to evaluate the RSSAS performance 
for various aircraft, environment, and system conditions. The intent of the 
individual analyses is discussed below. 

Statistical Performance — A statistical evaluation of the performance of 
each control law was conducted in a turbulent air environment. For the 
initial control laws, this analysis was used to eliminate configurations which 
did not add to the RSSAS capability. The final selected control laws were 
analyzed to provide an insight into the flying qualities to be exhibited 
during the motion base simulator tests. 

Aircraft Configuration Changes - The augmented aircraft response to flap 
and landing gear extensions was evaluated to compare the capabilities of 
various control laws when no special aircraft configuration intelligence is 
provided. 

Control Law Sensor Sensitivities — Each control law was evaluated to 
determine its sensitivity to sensor signal variations. This analysis was 
performed to establish the allowable sensor tolerances and/or sensor com- 
parison monitor thresholds. 
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Control Law Tracking - For a given flight patch tracking maneuver, each 
control law was monitored to evaluate the relative differences in control 
commands. This establishes the level of synchronization necessary for control 
laws in standby. Control -law-to-control -law comparison capability is also 
determined. 

FGS/RSSAS Interaction/Operation - This analysis establishes the inherent 
static stability augmentation capability of various combinations of the 
flight guidance system autopilot and autothrottle. Flight guidance system 
performance with and without the RSSAS is also evaluated. Although automatic 

flight control is demonstrated, several performance characteristics may be 
valid for manual pilot control. 

5.5.1 Statistical Performance Analysis. — An existing general-purpose linear 
control system analysis computer program was adapted for use in statistically 
evaluating the response of the proposed control laws in a turbulent air 
environment. As shown in Figure 5-18, the analysis was affected by subjecting 
the closed loop linearly modeled system to simultaneous longitudinal and 
vertical wind gusts, input through aerodynamic coupling as well as through 
the appropriate sensors. The Dryden wind gust models for angle-of-attack and 
forward-velocity gusts, as defined in MIL 8785-B, were used. The standard 
deviations of the aircraft variables Were computed by solving for the steady- 
state matrix variance equation for the linear system driven by white noise. 

The aircraft variables observed include: pitch attitude (e), pitch rate (0), 
angle of attack (a), velocity (u), altitude rate (h), normal acceleration 
(A|\j), and elevator deflection (se). 

Of the initial 32 control law configurations, 11 were eliminated by ex- 
cluding longitudinal acceleration, A x , as a feedback parameter prior to this 
analysis. Statistical gust responses for the remaining 21 control laws have 
been computed and bar diagrams drawn. Figures 5-19 and 5-23 shows the relative 
0 , a. An and se performance between each of the control law configurations 
for a cruise flight condition. Based on this evaluation, altitude rate (h) 
was eliminated as a feedback parameter. This was due to its degrading effect 
on some sensor combinations and its consistently lower level of performance 
compared with airspeed (u), the other air data computer parameter. 


122 




I FEEDBACK 
I PARAMETERS 


FIGURE 5-18. MODELED SYSTEM BLOCK DIAGRAM 


As a result of this and concurrent studies, the original 32 control laws 
have been reduced to the eeua family of seven (e 0 ua,ee,eea,e 0 u,ua,u,a) 
configurations. The remaining seven have been revised (gains and filter 
changes), new statistical gust responses were computed, and bar charts drawn. 
Figures 5-20 and 5-21 show the new gust responses for the cruise and approach 
flight conditions. An evaluation of these responses can provide an insight 
into comparative system/aircraft performance. o6 a and a: are indications of 

6 Og 

control law sensitivity to gusts, and a*,oA N and relate to passenger ride 
comfort. Tight augmentor control is reflected in c e and a o , while a u indi- 
cates possible coupling to the aircraft thrust control. Three control laws. 
No. 1 ( 00 ua) , No. 3 (00a), and No. 5 (a) were demonstrated on the motion base 
simulator (MBS). During the MBS tests, the higher values of 0 and A^ for the 
No. 5, a, control law manifested themselves with pilot opinions of a more 
active aircraft. The No. 1, eeua, control law has the tightest 0 control 
which also agrees with several pilot comments during the tests. 

5.5.2 Aircraft Confi guration Changes. - No special intelligence has been 
added to the RSSAS to sense and compensate for aircraft configuration 
changes. The RSSAS control laws do, of course, respond to the perturbed 
aircraft parameters in such a manner as to maintain the previous trimmed air- 
craft flight path. Figures 5-22 and 5-23, provide comparisons of the 
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FIGURE 5-20. STATISTICAL PERFORMANCE - CRUISE (CONTINUED) 
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FIGURE 5-22. COMPARISON OF AUGMENTED AND AUGMENTED EET IN APPROACH - 
GEAR EXTENSION 



FIGURE 5-23. COMPARISON OF UNAUGMENTED AND AUGMENTED EET (APPROACH FLIGHT 
CONDITION - FLAP EXTENSION 10 TO 30 DEGREES) 
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unaugmented 25 percent center-of-gravity EET, unaugmented 40 percent center- 
of-gravity EET and augmented (control law No. 5, a,) 40 percent center of- 
gravlty EET responses to landing gear and flap extensions. In all cases 
shown, no correcting pilot control has been applied, but during actual flight 
conditions, the pilot or autopilot would immediately compensate for the normal 
aircraft responses. 

The landing gear responses in Figure 5-22 shows that the neutrally stable 
40 percent center-of-gravity EET responds to this maneuver with an undamped 
pitch-down. Both the unaugmented 25 percent center-of-gravity and augmented 
40 percent center-of-gravity EET respond to the gear extension with a con- 
ventional pitch-down, decreasing the angle of attack, and increasing airspeed. 
All of the augmentation configurations will attempt to maintain the trimmed 
condition. As shown in Figure 5-22, the augmentor provides nose-up elevator 
(negative sign) and the aircraft demonstrates the least landing gear effect. 

Figure 5-23 shows the aircraft responses to the flap extension. (The 
low-drag flap design of the EET does not need a significant increase in 
thrust to maintain the approach airspeed for this configuration change.) The 
unaugmented 25 percent center-of-gravity EET response is similar to that of a 
conventional aircraft with an immediate angle-of-attack reduction and pitch- 
up, followed by an increased angle-of-attack and a reduced steady-state pitch 
altitude . as the aircraft slows down and descends. The unaugmented 40 percent 
center-of-gravity EET responds to the configuration change with a continuous 
pitch-up maneuver. The augmented 40 percent center-of-gravity EET responds 
immediately to the change in angle of attack and pitch, and applies nose-down 

elevator (positive), which improves the 40 percent center-of-gravity response. 
The 0.027 radians (1.5 degrees) of elevator is not sufficient, however, and 
the resulting 0.25 radians (15 degrees) is considerably greater than the mid 
25 percent center-of-gravity response. 

5.5.3 Control Law Sensor Sensitivity . — An evaluation of the control law 
sensitivity to variations in sensor signals was performed by establishing 
representative sensor errors, inserting these tolerances in the RSSAS DETAC 
simulation, and then comparing the resultant responses to the elevator and 
thrust upsets with those of the nominal system. The sensor tolerances were 
obtained from a composite of the specification values, results from accept- 
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ance testing, and from the DC-10 in-service experience. They are presented 
in Table 5-2. The greatest deviation from nominal, whether empirically 
evidenced in the specifications or statistically obtained, was set as the 
maximum allowable tolerance. 

Testing was conducted using the eeua control law family (No. 1 through 
No. 7) with the 40 percent center-of-gravity EET for both the cruise and 
approach flight conditions without turbulence effects. Upsets were introduced 
in the form of a 0.01745-radian (one-degree), one-second elevator step and a 
steady-state thrust increase of approximately 6300 newtons (1430 lb). Runs 
were made using nominal sensor values and then repeated with sensor gains set 
to the maximum positive tolerance and again with gains set to maximum negative 
tolerance as shown in Table 5-3. Comparison of the data presented in Appen- 
dix 9 shows good correlation between the nominal value runs and the maximum 
tolerance runs, except for control law No. 3 (eea) in the cruise case. 

As will be noted in the data package for these runs, several combinations 
of off-nominal values for the pitch and angle-of-attack sensor signal inputs 
to control law No. 3 were demonstrated. The data show that large excursions 
of the pitch sensor gain result in unstable — possibly divergent — response, 
whereas similar excursions of the angle-of-attack sensor gain result in 
heavily over-damped response characteristics. 

With the exception of some necessary refinements to control law No. 3 
gain terms, the data demonstrate that the control laws are adequately 
insensitive to anticipated levels of sensor-tolerance variations. This allows 
setting the sensor comparator levels at a value sufficiently high to eliminate 
nuisance warning, yet assure adequate performance capability. 

5.5.4 Control Law Tracking. — Control -law-to-control -law tracking for the 
eepa control law family (No. 1 through No. 7) has been evaluated with the 40 
percent center-of-gravity EET in a moderate turbulence with RMS level of 2.3 
meters/sec. The test runs were made for the approach and cruise flight con- 
ditions, and initiated with an upset of 0.0175 radian (1°) of elevator for 
one second. Each of the seven control laws was allowed to augment the air- 
craft and the instantaneous commands of the other six control laws were com- 
pared to the active control. Excellent correlation was observed between 
the active and standby control laws. Figure 5-24 shows the precise 
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TABLE 5-2 

SENSOR TOLERANCES 



COMPONENT SPECIFICATION 

INFLIGHT 

PERFORMANCE 

DEVIATIONS 

MANUFACTURE OR 
MAINTENANCE 
ACCEPTANCE 

SENSOR 

ACCURACY 

BIAS 

NOISE 

ANGLE OF ATTACK (a) 
DUAL OUTPUT 

±0.0044 RAD (±0.25 DEG) 

±0.0018 RAD 
(±0.1 DEG) 


NO DATA 
AVAILABLE 

±0.0044 RAD (±0 25 DEG) 

MOUNTING 


±0.0044 RAD 
(±0.25 DEG) 




NORMAL ACCELERATION (Aj 

±0.01 g n 

±0.002g n 

±0.002g n 

la = ±0.06g n 

±0.0075g 

n 

MOUNTING 


±0.0044 

(±0.25) 

AIR DATA COMPUTER 




1<r = ±0.22 M/S 
(±0.54 KN) 


1. AIRSPEED (u) 

±2.57 M/S (±5 KN) AT 30.87 M/S (60 KN) 




AS IN ACCURACY SPECIFICATION 


±1.03 M/S (±2 KN) AT 51.44 M/S (100 KN) 




AS IN ACCURACY SPECIFICATION 


±1.03 M/S (±2 KN) AT 102.89 M/S (200 KN) 




AS IN ACCURACY SPECIFICATION 


±2.06 M/S (±4 KN) AT 231.5 M/S (450 KN) 




AS IN ACCURACY SPECIFICATION 

2. ALTITUDE RATE (h) 

±5 PERCENT OR 0.15 M/S (30 FPM), 
WHICHEVER IS GREATER 



Iff = ±0.22 M/S 
(±0 707 
FT/SEC) 


VERTICAL GYRO 






PITCH ATTITUDE W| 

TAKEOFF ±0.021 RAD (±1.18 DEG) 
CRUISE ±0.006 RAD (±0.35 DEG) 

DESCENT AND LANDING 
±0.020 RAD (±1.15 DEG) 



Iff = ±0.00134 
RAD 
(±0.077 
DEG) 

±0.0087 RAD (±0.5 DEG - 
STATIC CHECK) 

MOUNTING 


±0.0018 RAD 
(±0.10 DEG) 





















TABLE 5-3 

MAXIMUM TOLERANCE RUNS 


SENSOR SIGNAL 


TOLERANCE 



Cruise 

Approach 

Velocity 

+ 1% 

+ n 

Pitch 

+1 0% 

++15% 

Alpha 

+m 

+ 5% 

Pitch Rate 

+ n 

+ U 


correlation of the comparisons with control law No. 1 (eeua) as the active 
control. The results of this analysis assure that minimal command synchron- 
ization is necessary for the control law in standby. Also demonstrated is a 
possible application of control -law-to-control -law comparison for system 
monitoring. 


5.5.5 Flight Guidance System/RSSAS Interaction-Operation . — The Flight. 
Guidance System (FGS) performance with the 40 percent center-of-gravity EET 
was evaluated for a flightpath tracking task consisting of control to a 
selected positive rate of climb and then a transition to a fixed altitude. 

In Figure 5-25, the FGS autopilot performs the specified maneuver with a 
fixed throttle setting which allows an increasing velocity as the aircraft 
levels to hold altitude. Approximately 0.007 radians (0.5 degrees) of elevator 
is required for a satisfactory altitude capture. With the autothrottles 
engaged. Figure 5-26 shows that the reduction in thrust to maintain airspeed 
results in a significant nose-down pitching moment which causes the aircraft 
to deviate from the selected altitude. (Elecom is the autopilot elevator 
command and Augcom is the sum of the autopilot and RSSAS commands.) The 
autopilot responds to the pitch-down but is limited at approximately 0.044 
radians (2.5 degrees) of elevator authority for this flight condition. In 
Figure 5-27 the autopilot, autothrottle, and RSSAS are all engaged, and 
once again a satisfactory altitude capture is performed. During the capture 
maneuver, the autopilot applies 0.012 radians (0.69 degrees) of nose-down 
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FIGURE 5 24b. COMPARISON OF CONTROL LAW NO. 1 WITH OTHER CONTROL LAWS - CRUISE 
CONFIGURATION - CONTROL LAW NO. 1 ACTIVE 
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FIGURE 5-25. AUTOPILOT ALTITUDE CAPTURE WITHOUT AUTOTHROTTLES - UNAUGMENTED, 40% CG 
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FIGURE 5-26. AUTOPILOT ALTITUDE CAPTURE WITH AUTOTHROTTLES - UN AUGMENTED, 40% CG 
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FIGURE 5-27. AUTOPILOT ALTITUDE CAPTURE WITH AUTOTHROTTLES - AUGMENTED, 40% CG 
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(positive) elevator and the RSSAS provides 0.008 radians (0.46 degree) of 
nose-up (negative) elevator for a total command (Augcom) of 0.004 radians 
(0.23 degree) of nose-down (positive) elevator. Then, as the autothrottles 
reduce the thrust and the aircraft pitches nose-down, the autopilot applies 
0.028 radian (1.6 degrees) of nose-up elevator and the RSSAS provides 0.017 
radian (0.97 degree) of nose-up elevator, for a total of 0.045 radian (2.58 
degrees) of nose-up elevator. 

The results of these tests indicate that the conventional autopilot can 
easily handle the aircraft's relaxed static stability, but when coupled to 
a significant pitch/thrust coupling, it does not provide the necessary 
elevator response. Also observed in the fixed- throttle maneuver of Figure 
5-25 were several large command reversals during the capture. When the 
RSSAS was engaged, these reversals were significantly reduced, as was the 
frequency of the autopilot command input. 
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SECTION 6 

SYSTEM ARCHITECTURE DEVELOPMENT 


The RSSAS is a multichannel avionics system consisting of the appropriate 
sensors to describe the aircraft response, Flight Augmentation Computers (FAC) 
to perform the control calculations to achieve the desired flight response, 
an actuation system which transforms the computations into longitudinal air- 
craft control, and hydraulic and electrical systems to provide the necessary 
power for the other elements. Figure 6-1 is a diagram of the major RSSAS 
elements. Operationally, the RSSAS is independent of other normal aircraft 
flight controls and will function continuously in conjunction with either 
pilot or automatic pilot control. RSSAS aircraft control is accomplished 
through the elevator surfaces wherein augmentation commands are summed with 
the primary flightpath commands to provide a total surface deflection. 

Unlike the primary control commands which are reflected back to the control 
column, the RSSAS control is performed by a series actuator, the displacement 
of which will not be reflected back into the primary flight control system. 

The elements in developing the system include- (1) the system design 
requirements, (2) the formulation of proposed configurations, and (3) the 
evaluation of several selected candidates. Figure 6-2 shows the relationship 
of these elements. The system design requirements are obtained from the 
initial study constraints and the results of other study tasks. They define 
the fixed hardware requirements or hardware flexibility, the existing and 
desired flying qualities, the necessary functional reliability and safety, 
and the augmentation control requirements. The architectural formulation 
tasks then define: (1) the individual system components, (2) their level 

of redundancy, (3) their functional capability, (4) the interconnection of 
the devices, and (5) the characteristics of the architecture which could 
impact the design of the system/ aircraft. Finally, the evaluation task 
determines the merit of the proposed systems with regard to the established 
requirements and also compares the satisfactory systems in order to select 
the most promising candidates for further consideration. 
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FIGURE 6-1. MAJOR RSSAS ELEMENTS 



FIGURE 6-2. RELATIONSHIP OF THE SYSTEM DESIGN TASKS 
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6.1 System Design 


6.1.1 Sensors. — The sensors considered for the relaxed static stability 

computation consist of all devices whose combination of parameters provides 
sufficient dynamic aircraft data to be used in the calculation of the aug- 
mentation control laws. The candidate parameter list includes: pitch 

attitude (0), pitch attitude rate (0) , angle of attack (ot), airspeed (u), 
altitude rate (h), longitudinal acceleration (A ) and normal acceleration 

X 

(A^). The baseline equivalent DC- 10 sensor arrays which provide these data 
are: 

• Three vertical gyros for 0 and 0 

t Two angle-of-attack vanes for a 

• Two air data computers for u and li 

t Two accelerometer units for A and A... 

x N 

The vertical gyros provide 0 as an analog two-wire output and the FAC 
must derive 0 from this signal, a as used for the RSSAS is actually the 
average value of the two wing-mounted (one on each wing) dual transducer 
vanes, which have been calibrated for induced-flow effects. Each digital air 
data computer provides both u and fi on a common serial digital data bus. The 
accelerometer units provide both A x and A^ as two-wire analog signals with 
an additional 28 VDC discrete validity for A^ which is determined by 
comparing dual A^ accelerometers. The pitch/thrust compensation calculations 
are based upon the N-j thrust parameter of each engine. The N-. signal is 
provided as a two-wire analog signal from the engine indicator system. 

A strapdown Attitude and Heading Reference System (AHRS) was considered as 
a variation to the baseline DC-10 sensors. Three AHRS units replaced the 
vertical gyros and accelerometer units supplying e, 0 , A x and A^ on a common 
serial digital data bus. Resulting reliability calculations were essentially 
identical to the DC-10 sensors, so the tabulations are not repeated. 

6.1.2 Flight Augmentation Computers (FAC). - A specification of the FAC 
includes both the definition of the internal hardware mechanization and a 
detailed description of its functional operation. The system analysis and 
simulation of this study require a rather extensive development of the 
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functional operation but a detailed hardware architecture is not necessary 
nor will it be established. It is assumed, however, that the hardware mech- 
anization will be digital and that the individual computers will be capable 
of full internal failure detection. This and several other hardware char- 
acteristics will be discussed in general. 

6. 1.2.1 Hardware Architecture. — The main hardware elements within a 
digital computer are the input/output (I/O) circuits ? memory, and central 
processing unit (CPU). The I/O is required to provide the interface with all 
external components of the system which include the sensors, actuators, 
control and annunciation units, and the other RSSAS computers. The computer 
memory stores the data required for the system calculations performed by 
arithmetic operations and logic decisions of the CPU. Using these elements, 
several different architectures may be constructed to satisfy the system 
requirements. The following configuration summaries are the primary near- 
term concepts which are intended to provide full internal fault-detection 
capability. 

The single-path, dual-processor architecture shown in Figure 6-3 
includes two central processors while most of the other elements are single- 
string. It is argued that if the processors themselves can be guaranteed to 
be functioning properly by comparing their outputs, the rest of the machine 
can be shown to function by various error-detection schemes. It is felt by 
the advocates of this architecture that one may be able to avoid a detailed 
Failure Modes and Effects Analysis (FMEA) of the processor since the second 
processor (which may be dissimilar) is always watching the first processor. 

The dual-path, single-processor architecture shown in Figure 6-4 consists 
of dual paths ( i . e . , dual memory, I/O) within the machine but uses a single 
processor to operate on the data. After the A and B sensor sources are con- 
verted to data words in separate memory locations, the data values are 
compared. The data are then averaged and control laws are computed twice 
and compared. If the control law computations are valid, the data are sent 
out to the servo-amplifiers through the digital to analog converters. The 
outputs of the D to A converters are sent back through the input analog to 
digital converters and compared with what their value should be. If the 
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output is valid, servo response must be checked. The servo position is sent 
back through the input and compared with what its response should be. In 
this way the entire system is monitored. 

The key to the whole process is the integrity of the processor itself. 

It must be fully monitored. Several techniques for ensuring proper function- 
ing of the processor will be discussed later in this report. 

The dual -path, dual-processor architecture is essentially the packaging 
of two completely independent computers in one line- replaceable unit (LRU). 
This is the direct equivalent of today's analog dual-channel fully monitored 
computers, and many of the cross-comparison techniques described above are 
applicable. Manufacturers differ in the details with regard to frame 
synchronization, I/O handling, etc. In general, the internal comparators 
are set a little wider since each channel is either not operating on the 
same data or receives the same data through different I/O devices. Time 
skewing and data freshness affect channel -tracking tolerances also. 

6. 1.2. 2 Functional Architecture. — The functional requirements of a 
FAC are shown in Figure 6-5 and consist of: (1) processing data between the 
computer and the external system components; (2) performing the control 
computations; (3) maintaining executive control of the internal functions, 
and external actuation control and communications, and (4) monitoring the 
system functions. Each computer within the RSSAS performs these functions 
identically and independently except that such operations may be pre- 
programmed decisions based upon the other computer data transfer. 

(a) Data Processing. The computer must interface with three different 
types of signals: Analog, 28-VDC discrete, and serial digital data. 

The largest anticipated interface list for the RSSAS function is 
itemized below: 

Inputs 

Analog (2-wire) 

*3 - Pitch Attitude 
*2 - Vertical; AccgT;$rati on 
4 - Angle of Attack 
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SERVO OUTPUT (TO ENO-AROUND TEST) 


SENSORS ^ 


SERVO(S): w 


COMPUTERS ^ 

INPUT 

TRIM ^ 

PROCESSING 

ENGAGE 



SERVO COMMAND (TO SERVO MODEL) 


PERFORMANCE MODEL 


ttt 


SENSOR DATA 


DATA TRANSFER 


CONTROL 

COMPUTATION 


MONITOR 


VALIDITIES 

- SENSORS 

- I/O 

- COMPUTER 

- SERVO 

- TRIM 


EXECUTIVE 


SERVO COMMAND 

TRIM COMMAND 

TRIM DIRECTOR COMMAND 


ENGAGE 

STATUS 

CAUTION/WARNING 
DATA TRANSFER 

- DATA SELECT 

- CONTROL SELECT 

- GAIN 

- SERVO COMMAND 

- TRIM COMMAND 

- STATUS 

- ENGAGE 


OUTPUT 

PROCESSING 


SERVOS 


TRIM 


TRIM DIRECTOR 


CAUTION/WARNING 


STATUS 


DATA TRANSFER 


ENGAGE 


FIGURE 6-5. FLIGHT AUGMENTATION COMPUTER FUNCTIONAL DIAGRAM 







2 - N-j (Engine' Thrust) 

2 - Series Elevator Actuator Position 
2 - Horizontal Stabilizer Position 
2 - Primary Elevator Control Position 
1 - Manual Airspeed Slew 

28-VDC Discrete (1-wire) 

*2 - Vertical Acceleration Validity 
1 - System Engage Logic 

1 - Test Initiate Logic 

Serial Digital Data Bus (2-wire) 

2 - Airspeed 

2 - Computer Intercommunication 

1 - Maintenance System 

*May be replaced by 3 - Attitude Heading Reference System, 

2-wire serial digital data buses. 

Outputs 

Analog (2 -wire) 

2 - Series Elevator Actuator Command 

28-VDC Discrete (1-wire) 

4 - Trim Command 

2 - Trim Director Command 

2 - Series Elevator Actuator Engage 

1 - System Warning 

1 - Pitch/Thrust Warning 

Serial Digital Data Bus 

1 - Intersystem Communications 

Figure 6-6 is a typical hardware mechanization which shows the 
required data-processing. interfaces . At the input, the analog 
s i gnal s are condi ti onecL and mu 1 ti pi exed then converted to di gi tal 
and impressed onto the input data bus. The 28-VDC discretes are 
packed into digital words- with each input typically representing a 
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FIGURE 6-6. COMPUTER BLOCK DIAGRAM, MONITORED PLUS INTERCOM 



















single bit of the word and sequenced onto the input bus. The serial 
digital data buses require a serial-to-parallel conversion prior to 
interface with the data input bus. The output data are provided by 
picking the appropriate data of the CPU output data bus and reversing 
the operations performed at the input. 

(b) Control Computation. The control computation function performs the 
necessary operations, as shown in the flow diagram of Figure 6-7, to 
select or synchronize the appropriate control laws, compute the 
selected control law, and provide the corresponding series elevator 
actuator and horizontal stabilizer commands. The control logic is 
provided by the executive function and the command outputs are fed 
back to the monitor as part of the validation process. Figure 6-8 
shows the computer mechanization of the control law forms shown in 
Section 5, Figure 5-3. 

A single control law is represented in the figure showing the system 
pre-engage synchronization (power-up value), and control law in 
standby synchronization (sample and hold, S/H), The pre-engage 
synchronization essentially establishes the existing aircraft inputs 
as the trim condition at engagement. The standby synchronization is 
active whenever the associated actuator is engaged but that control 
law is not active. This will assure that at the moment of transfer 
between control laws, identical servo commands are present; there- 
fore, a surface transient will not result. Also, since the pilot can 
maneuver the aircraft with the primary horizontal stabilizer trim, 
the pilot command input to each control law is a combination of 
these two commands. The stabilizer position has, however, been con- 
verted to equivalent elevator by the gain factor which is approxi- 
mately a constant 1.613 over the flight envelope of interest. 

Each control law mechanization has a unique sensor input array, 
observer, and gain matrix. Selection of the appropriate control law 
is performed in accordance with the logic from the executive func- 
tion. The selected control Taw command is then output to the series 
elevator actuator. The automatic series elevator trim function 
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EXECUTIVE 


DATA 



ELEVATOR ACTUATORS 

FIGURE 6-7. CONTROL COMPUTATION FLOW DIAGRAM 

interfaces at this point and this feature will be discussed in detail 
in Paragraph 6.1.4. 

Gain programming of the control laws is accomplished using the air- 
speed input from the air data computer. Should both air data com- 
puters fail, the gain programming reverts to the input from the 
manual airspeed slew switch on the overhead instrument panel, which 
is activated by the flight crew. 

(c) Executive Control. The executive function determines and controls 
the actuator engagement, control law selection, and status/warning 
data transfer. The flow diagram in Figure 6-9 shows that the execu- 
tive decision process is initiated with an input from the monitor 
function. Based on the validity of the computer and actuator, and 
provided an engage logic from the RSSAS controller is present, the 
associated actuator will be supplied an engage command. The validity 
of the sensor array is used to determine the available control laws 
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FIGURE 6-8. RSSAS CONTROL COMPUTATION BLOCK DIAGRAM 










MONITOR 



FIGURE 6-9. EXECUTIVE FUNCTION FLOW DIAGRAM 

and then, in conjunction with the status of the other computers and 
the actuator engagement, the best control law is selected for control 
and the others are synchronized. Appropriate logic functions are 
picked off for status/warning annunciation and for data transfer to 
the other RSSAS computers. 

A more detailed flow diagram of the actuator engage and system warn- 
ing is shown in Figure 6-10. The computer first determines if the 
associated engage switch has been selected. If not, the warning 
light output is reset and the actuator is not engaged. With the 
switch on, the computer validity must be present and a control law 
available (unit control law not in standby) to continue the logic 
process for actuator engagement. If not, the system warning is set. 
Next, with the computer configured for the control of two actuators, 
the validity of the first is checked and if present, the actuator is 
armed. Now, if a satisfactory total system control law is available 
(one which agrees with the other computers or gives best performance 
available), the actuator is engaged. This sequence is then performed 
on the second actuator (note that a warning will be provided if 
either actuator is armed and a control law is not available). 
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FIGURE 6-10. ACTUATOR ENGAGE AND SYSTEM WARNING 















The most complex task of the executive function is to select the 
system control law. Figure 6-11 is the flow diagram for determining 
the highest-level control law available to a given computer - unit 
control law (UCL). This process determines from the monitor output 
which sensors are available. The UCL is then selected as the control 
law which uses the greatest number of sensors. This control law, 
however, may not be in agreement with the control law of the other 
computers due to tolerances or failure conditions. Common control 
laws, while not yet proven to be essential, do seem to be desirable 
for surface-to-surface tracking and total system performance. For 
this reason, each computer independently determines the system 
control law (SCL). 

Figure 6-12 (a, b, c and d) shows the flow diagrams for the selection 
of the SCL (note that this diagram is for the No. 1 computer). In 
Figure 6-1 2a, the actuator arm/engage status of each computer is 
examined and, if OFF, all control law flags of that unit are set to 
"failed" for the purpose of selecting the SCL. In Figure 6-1 2b, the 
flags determined in 6-1 2a are counted and if all computers have 
common valid sensor arrays, the highest level (most sensors) control 
law is selected. 

Figures 6-1 2c and 6-1 2d show the process followed to determine the 
SCL when all of the computers do not have a common control law avail- 
able. The objective of this logic sequence is to determine if two 
computers have a valid, common control law and, if so, that SCL is 
selected and the computer that is not in agreement has its SCL put 
in standby (STBY). If no two computers agree, all computers revert 
to their UCL, which is considered the best decision available. 

The thrust/pitch compensation function is also controlled by the 
executive as shown in Figure 6-13. Dual outputs for each engine 
are provided from the thrust-indicating system to each FAC. These 
N-| signals are compared by the system monitor to determine the 
validity of the data and, if a failure is not detected, the thrust 
term used in the compensation calculation is M-j = No. 1 N-| + No. 2 
Nj . If either engine datum is determined to be failed, N-j is set 
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SETTING CONTROL LAW FLAGS (CLF) 


START 



TO FLAG COUNT AND NO FLAG CONTROL LAW SELECT 
(SEE FIGURE CONTINUATION) 

FIGURE 6-1 2a. SYSTEM CONTROL LAW (SCL) SELECTION FLOW DIAGRAM 

equal to that of the valid datum. With both engines still operative, 
this will result in essentially half the required thrust-control gain 
with an accompanying caution annunciation. If both data sources fail, 
the thrust/compensation is put into hold and the appropriate warning 
light comes on. 

(d) Monitoring System Functions. A variety of methods is used to detect 
failures within the computer and its associated components (sensors 
and actuators). Some of these techniques are aimed at specifically 
validating a hardware function. Others determine the system's 
health by evaluating its performance or potential performance ability. 
Such concepts are highly dependent upon the function, architecture, 
and intended performance of the system. The following discussion 
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FROM CLF SET 


Ft. AG COUNT AND NO FLAG CONTROL LAW SELECT 



SCL = t 


FIGURE 6-12b. SCL FLOW DIAGRAM (CONTINUED) 


will highlight those monitor concepts intended for the RSSAS. Most 
of these are continuously functioning during flight or on the ground 
and are an integral part of both the monitoring and maintenance 
functions of the system. 
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FIGURE 6-12c. SCL 
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FIGURE 6-1 2d. SCL FLOW 
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WITH FLAGS 



(CONTINUED) 






















FIGURE 6-13. THRUST-COMPENSATION SIGNAL SELECT FLOW DIAGRAM 


Computer Tests: 

CPU Instruction Test - The CPU instructions can be exercised by per- 
forming arithmetic and logic operations by inserting known values, 
performing the functions, and comparing the answer with a known final 
result. 

CPU Fixed Memory Tests — The permanent memory can be tested by a 
check routine which determines the number of 1's in data storage, and 
compares this number with a known result. 

Scratch Pad Memory Test — The scratch pad memory can be tested by 
driving all locations in the memory to l's, then to 0's, for read-in/ 
out comparison, and verifying each bit is in the proper state. At 
the completion of the test, the original contents of the memory 
location are restored. 

Analog/Digital (A/D) Test — A/D converter testing is accomplished by 
inserting a known reference voltage to the A/D converter, sampling 
the converted digital word, and then comparing it with the known value. 
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Computer Power Supply Test - The regulated power supplies can be 
tested by digitizing each voltage one at a time, through the A/D 
converter, and comparing them with known tolerances in the CPU. 

Input Circuits Test - Analog input circuits can be tested by measur- 
ing two redundant channels for each input signal. The demodulator 
references are also converted to a known nominal value. The discrete 
input circuits are tested by applying logic stimuli to verify that 
the circuits are operational, by performing a decoder check, and by 
performing a stimulus removal check. 

Output Circuit Test - All analog outputs can be tested by gating each 
back through the input analog multiplexer and the A/D converter, and 
then comparing this digital value with the known digital word which 
originally initiated the analog output. The computer discrete out- 
puts are also reconverted into an input digital test word. This 
word is then compared with the known digital word which commanded 
the original discrete outputs. 

Hardware Monitor - The preceding tests all require that the computer 
be running to be able to detect faults. It is also necessary to 
detect the fact that the computer stops functioning completely, such 
as in the absence of power or failure of the internal clock. This 
is accomplished by a square wave or "heartbeat" monitor. As the 
computer cycles through its program, it turns a signal on and off 
each cycle. The resulting square wave is monitored with hardware 
such that if the signal stops oscillating at the proper frequency 
(for example, 20 Hz), the engage solenoid of the actuator will dis- 
engage. Such a device is shown in Figure 6-14. 

The above list does not presume to include all possible tests which 
are, or could be, included in the self-check routines of a specific 
digital computer mechanization; however, it does represent a general 
set which could apply to any machine. These kinds of tests, taken 
as a whole, are comprehensive in that they address all of the func- 
tional elements within the computer. 
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Sensor Tests: 

Comparison and Voting — The RSSAS sensors will vary in degree of 
internal monitoring capability. Monitoring of these devices is 
accomplished by installing them in the vehicle in a way that makes 
each one completely independent of the other, and comparing (for two 
sensors) or voting (for more than two) the sensor outputs. Thresh- 
olds for the comparators are established by statistical models of the 
sensor and computer tolerances, and when the threshold is exceeded, 
both sensors are no longer used and the system shuts down or reverts 
to other modes of operation. 

Sensors with digital outputs have validity incorporated in the word 
itself. The sign-status matrix, as it is called, dedicates 2 or 3 
out of 32 bits to the validity of the signal. Some manufacturers 
feel, however, that there are failure modes in the sensor for which 
they cannot guarantee to set the digital word to a fail status. The 
alternative for the system designer then is to continue to look at the 
28-VDC validity which does not properly reflect status, or ask the 
sensor supplier to remove the digital word altogether from the wire, 
which they agree they can do. 

Parity Checks — For data transmitted on a digital bus, one bit of 
the 32-bit word is dedicated to parity. The bit indicates whether 
the total bit sum is even or odd, thus giving the user/flight control 
computer a way of establishing confidence in the transmitted signal. 
Parity is not a self-sufficient means of establishing validity, 
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since it will catch word errors only about half of the time. But 
since data rates are very high, parity errors will occur fast enough 
in a failed device to make the technique useful. 

Reasonableness Check — The computer can assess a particular sensor's 
validity by comparing its data with data derived from an independent 
dissimilar sensor. Thus, if vertical speed, as measured by an air 
data sensor, makes a sudden change without a change in lagged normal 
acceleration, one would suspect either or both sources. Considerable 

effort is now being expended along these lines in an attempt to 
minimize the number of redundant sensors required aboard a vehicle. 

Actuation Tests - Surface actuators are probably the most common 
devices to be modeled since they include several nonlinearities, or 
authority limits. Models are simply inserted into the comparator 
path before the comparison is made, and can detect such phenomena 
as hardovers, loss of hydraulic pressure, and servo-amplifier 
failures. 

System Tests — Comparison and voting within the computer. The output 
commands of the several redundant, but uniquely different, control 
law computations have been demonstrated to track each other with a 
relatively high degree of accuracy. In the cases evaluated, a single 
control law was selected for augmentation control, while the others 
were being calculated but were in standby. In such a configuration, 
it appears that control -law-to-control -law comparisons can be used 
to validate the system performance. Failure of individual sensor 
elements could affect more than one control law type, which although 
detectable in the performance comparisons, would require several 
control law comparisons of dissimilar sensor arrays to provide fault 
isolation. 

Mechanical or Aerodynamic Voting - Multiple channels of control and 
actuation are often tolerant of failures which result in errors of 
single-command elements. These failures are voted out in the mechan- 
ical system or if the erroneous command is transmitted to a single 
segment of a multiple segment surface, aerodynamic voting takes 
place. (The DC-10 autoland configuration with quad elevator and 
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aileron surface segments is an example of aerodynamic voting.) 

These failures must, of course, be quickly isolated and removed in 
anticipation of any subsequent fault. 

Several of the RSSAS configurations which control a quad series 
elevator actuator arrangement can take advantage of similar voting 
characteristics. The quad-actuator, quad-surface configurations 
will vote aerodynamically. The quad-actuator configurations, with 

two actuators on each of two segments, can result in mechanical 
voting at the surface and then aerodynamic averaging of the two 
surfaces. This type of voting or averaging will be integral with 
RSSAS configurations regardless of whether the individual computers 
are operating with the same control laws (as was analyzed in this 
study) or whether each computer operates with a different control 
law which may be a desirable dissimilar computation configuration. 

Performance Modeling — Modeling can be used to either measure or 
predict the system performance. For the RSSAS, the anticipated 
command of each control law in response to aircraft upsets and 
environment conditions can be predetermined and then compared with 
measured control -law performance. Another method might be to estab- 
lish performance relationships between the various control laws as 
a function of the aircraft disturbance. These models could then be 
continuously evaluated in flight against the actual system perform- 
ance. The statistical evaluation studies of Section 5 could provide 
the basis for this type of monitor function. 

Figure 6-15 is a flow diagram of the RSSAS monitor function. The 
first step in this operation is to determine if the computer is cor- 
rectly functioning. If the computer is failed, all further opera- 
tions are in doubt; therefore, the executive is sent a message that 
flags all control functions. In addition, the computer flag is 
stored by the system maintenance function which accumulates all fail- 
ure information. With the computer valid, the other control func- 
tions are sequentially checked.- First, the actuator response is 
compared with the expected result determined with a model of the 
actuator. If two actuators are controlled, each is individually 
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FIGURE 6-15. MONITOR FLOW DIAGRAM 
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monitored. Next, each set of sensors is compared. When a failure 
is detected, a second check of the same sensors is made using the 
data transferred from one of the other computers. If that compari- 
son is also invalid, the sensor is determined to be failed; if not, 
the computer input port is probably failed. Finally, the trim 
system is monitored by putting all trim commands (pilot/autopilot 
and RSSAS) into a trim model and comparing this expected result with 

the actual horizontal stabilizer motion. All monitor data are then 
sent to the executive and maintenance functions for proper warning/ 
status annunciation, control selection, engagement decision and data 
transfer. 

Based upon the performance analyses reported in Section 5, two addi- 
tional concepts not shown in Figure 6-15 may be employed in RSSAS 
monitoring. In one concept, control -law-command-to-control -law- 
command comparison monitoring appears useful for several but not all 
control laws. The other concept is to establish statistical per- 
formance models of the control laws which could be used in either of 
two ways. First, the control law performance model could be deter- 
mined as a function of the environment. The monitoring task would 
then be to establish the environmental condition, call out the appro- 
priate model, and compare it to the actual control law performance. 
The second method would be to determine a model which correlates the 
performance characteristics of two or more control laws. This model 
could then be used to continuously compare the real-time system per- 
formance. None of these techniques has yet been developed but now 
that the RSSAS control laws and performance have been established, 
future studies will be aimed specifically at improved monitoring 
concepts. 

6.1.3 Actuation System. - Conventional commercial transport primary 
mechanical flight control systems operate in such a manner that as the pilot 
inputs move the control surfaces, this movement is fed back to reposition the 
pilot controls. When the automatic pilot operates in place of the pilot, it 
positions the surface by moving the primary control system with an auxiliary 
actuator. This mechanization is referred to as a parallel actuation system, 
since the autopilot input is essentially tied to the pilot controls and their 
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positions parallel each other. Augmentation systems which operate simultane- 
ously with the primary flight control? and share the same control sufaces 
require an additional series actuator interface which causes the same control 
surface to respond to the sum of the control commands, but without the series 
input being reflected back into the pilot controls. 

For the EET RSSAS, the elevator actuation system must be designed to pro- 
vide this series and parallel operation. The baseline primary elevator control 
system is that of the DC-10 shown in Figure 6-16. Several alternative configu- 
rations which provide the required function have been qualitatively evaluated, 
along with the necessary hydraulic power interface using the baseline system 
shown in Figure 6-17. 

6. 1.3.1 Actuation Configurations and Operation. - Six basic elevator 
actuation systems have been considered. These are shown in Figures 6-18 
through 6-23. The surface actuators incorporate tandem cylinders powered by 
two separate hydraulic system?, such that no single hydraulic failure can cause 
loss of any surface output. The auxiliary actuators for series and parallel 
commands, whether they are separate or Incorporated within the surface actua- 
tors, are single cylinder units, each powered by one of the two hydraulic 
systems driving the associated surface actuator. The rationale behind elimina- 
tion of the complexity of tandem cylinders for parallel and series actuators 
is that one parallel unit can drive the cruise autopilot and one pair of units 
is good for autoland, and loss of one or two series surface outputs is accept- 
able after a single hydraulic failure. 

Configuration A, shown in Figure 6-18, is the basic configuration. In it, 
a series and a parallel actuator are added in the linkage path to each surface. 
The parallel mode. actuator output rod is disengaged within the unit when 
hydraulic power is not applied, so that minimum friction is added to the 
system. The series mode actuator output rod is spring preloaded to the neutral 
position when hydraulic power is not applied, thus providing a reaction point 
for the summing link driving the surface actuator input. In this configuration, 
loss of hydraulic power to a series actuator causes loss of series outputs on 
its associated surface. 

Figure 6-19 shows Configuration B, which combines a series and a parallel 
actuator into a single unit which also transmits mechanical comnands. One of 
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FIGURE 6-16. LONGITUDINAL PITCH MECHANICAL CONTROL 



PR6-DC10-11110 

FIGURE 6-17. HYDRAULIC SYSTEM 
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FIGURE 6-18. ACTUATION CONFIGURATION A 
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FIGURE 6-19. ACTUATION CONFIGURATION B 
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these units is incorporated in the linkage path to each surface. Since the 
actuators incorporate single hydraulic cylinders, the outputs must be bussed 
together to prevent loss of mechanical control of one or two surfaces after a 
single hydraulic failure. As a result, loss of hydraulic power to one, two, 
or even three of the series/parallel actuators causes no loss of series 

command to the surfaces. This is not as advantageous as it appears, however, 
since loss of two hydraulic systems also causes loss of output of at least one 
and possibly two surface actuators. 

Configuration C, shown in Figure 6-20, combines three series and four 
parallel actuators into a single package located upstream of the control 
surface linkage bus. The individual actuators are identical to those of Con- 
figuration A. As in Configuration B, bussing of the series actuator outputs 
prevents loss of series commands after one or two hydraulic failures, although 
with two hydraulic failures one or two surfaces will also be inoperative. 

Figure 6-21 shows Configuration D, an integrated series/parallel actuator 
located upstream of the control surface linkage bus. This unit accepts mechan- 
ical, series electrical, and parallel electrical inputs and provides dual 
mechanical outputs to the control surface bus. For reasons given subsequently, 
this configuration was quickly eliminated, so no further description is given. 

Configuration E, shown in Figure 6-22, integrates the series actuators 
with the mechanical surface actuators. Units of this type are in common usage 
today, primarily in rudder actuators which incorporate yaw dampers. A parallel 
actuator, identical to those of Configuration A, is added in the linkage path 
to each actuator. As in Configuration A, loss of hydraulic power to the series 
portion of an actuator will cause loss of series output of that actuator. 

Figure 6-23 shows Configuration F, which integrates both the series and 
parallel mode actuators into the surface actuators. As in the previous con- 
figuration, loss of hydraulic power to the series portion of the actuator 
causes loss of the series mode output of that actuator. 

6. 1.3. 2 Actuation Configuration Evaluation. - The primary considerations 
in evaluating each of the proposed actuation configurations are discussed 
below: 
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MECHANICAL 
POWER 
ACTUATORS 
(TANDEM HYDRAULIC) 


SERIES/PARALLEL 
ACTUATOR PACKAGE 
(SINGLE HYDRAULIC 
ACTUATORS) 


FIGURE 6-20. ACTUATION CONFIGURATION C 



MECHANICAL INTEGRATED 

POWER SERIES/PARALLEL 

ACTUATORS ACTUATOR 

(TANDEM HYDRAULIC) 

FIGURE 6-21. ACTUATION CONFIGURATION D 
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HYDRAULIC) 


FIGURE 6-22. ACTUATION CONFIGURATION E 
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Configuration A 

• Maximum number of actuators. 

• Does not take advantage of existing unit capability. 

Configuration B 

• Primary pilot input linkage not direct to actuator - adds lag between 
pilot input and surface response. 

• Added weight of additional bus system at output of series/parallel 
actuator. 

• Does not take advantage of existing unit capability. 

Configuration C 

• Most flexible actuation arrangement - redundancy of autopilot and 
augmentation actuators easily changed to match reliability 
requirements. 

• Large number of actuatofs. 

• Does not take advantage of existing unit capability. 

Configuration D 

• Brings entire control system to a single, common point. Failure 
effects could be severe. 

• Very complex pilot, autopilot, and augmentation interface. 

(Internals not shown in diagram.) 

Configuration E 

t Requires add-on of autopilot actuators to existing configuration. 

• Existing actuators must be reworked (simple change) to provide series 
augmentation input rattier than parallel autopilot input. 
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Configuration F 


• Most adaptable to the existing mechanical configuration. 

§ Requires a one-for-one replacement of actuators. 

To keep the RSSAS incorporation to a minimum risk and minimum change, 
Configurations E and F are the candidate selections. For the further RSSAS 
studies, these configurations are identical since both include the integration 
of the series augmentor actuator into the primary power actuator. In the total 
system architecture evaluations, two other variations to the selected configu- 
rations were considered. These were: (a) dual series command inputs into a 

single series actuator, and (b) actuation configurations which do not include 
a series input at each surface segment. 

6. 1.3. 3 Hydraulic Arrangement. 

(a) Control Surface Actuators. The surface actuators are tandem cylinder 

units, each utilizing two different hydraulic power supplies. For 
maximum reliability, all power supplies should be represented and 
they should be represented as equally as possible. With three sup- 
plies, the optimum combinations would be 1-2, 1-3, 2-3. Since there 
are four actuators to supply, the fourth must duplicate one of the 
other three. For purposes of the hydraulic arrangement study, the 
three supplies are considered identical, thus it is immaterial which 
actuator is duplicated. The actuator supplies have therefore been 
allocated as follows: 1-2, 1-2, 1-3, 2-3. 

(b) Series Mode Actuators. Allocation of three hydraulic systems and/or 
three computer channels to three actuators is straightforward. How 
to optimize the allocation of three systems to four actuators is not 
immediately apparent. Several ground rules may be set up, however, 
for maximum reliability. First, a basic power source (i.e., engine, 
APU, etc.) will be used to generate both hydraulic power for the 
actuators and electrical power for the computer channels. These 
sources are designated as 1, 2* and 3, and hydraulic and electrical 
systems 1, 2, and 3 are each associated with the correspondingly 
numbered basic source. Thus, failure of a basic source will result 
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in loss of both the correspondingly numbered hydraulic system and 
electrical system. To prevent failure of a basic source from causing 
loss of more than one series mode channel, each channel (including 
the surface actuators) should utilize electrical and hydraulic power 
from a common basic source. A secondary source of hydraulic or 
electrical power may be used (as in the surface actuators) where its 
failure alone will not cause loss of that channel. If it is assumed 
that computation Channel 1 is supplied by electrical System 1, Chan- 
nel 2 by electrical System 2, etc., the above ground rules may be 
stated more simply as follows: 

• For a channel having one series mode actuator and one surface 
actuator, each actuator must utilize at least one hydraulic 
system numbered the same as the computation channel number. 

• For a channel having two series mode actuators and two surface 
actuators, each series mode actuator must utilize one of the 
systems used by its associated surface actuator. At least one 
of the series mode actuators must utilize a hydraulic system 
numbered the same as the computation channel number. 

Applying the above ground rules reduces the number of permutations of 
hydraulic systems and computer channels to a more manageable number. 
These cases were examined for the effects of all combinations of 
hydraulic and electrical failures up to the double-hydraulic, 
double-electrical level. Comparing the results on the basis of the 
number of surface actuators suffering a total loss of series com- 
mands, it is found that all cases fall into one of two groups. Con- 
figurations in which the two series mode actuators controlled by one 
computer are powered by the same hydraulic system, suffer complete 
loss of series mode capability for 12 failure cases. All other con- 
figurations suffer this same loss in only nine cases. Tables 6-1 
and 6-2 show the analysis for two typical configurations, one for 
each of the two groups. 

The configuration of the series mode actuators is such that they are 
readily adaptable to two inputs, one each from two different computer 
channels. In the event of a failure in one channel, the remaining 
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TABLE 6-1 

COMPUTER CHANNEL/HYDRAULIC SYSTEM 
FAILURE MODE EFFECTS 























































TABLE 6-2 


COMPUTER CHANNEL/HYDRAULIC SYSTEM 
FAILURE MODE EFFECTS 



























































channel would be capable of controlling the actuator within its 
normal authority, but at half-rate. This suggests the possibility 
of increasing reliability by applying commands from two different 
computer channels to each series mode actuator. An analysis, 
similar to that described above, was performed using this approach. 
Again, it was found that there is no real "optimum" arrangement 

Tables 6-3 and 6-4 show two cases typical of the "worse" and "better" 
groups of configurations. A comparison of Table 6-2 with Table 6-4 
(both representative of the "better" groups) shows that the dual 
inputs to the series mode actuators does result in fewer series 
command losses for the combined computer/hydraulic system failures. 
Although complete command losses are reduced, in most cases several 
or all of surfaces remaining active are operating at half-rate, thus 
reducing the servo-loop response and in some cases resulting in 
servo loops operating together but with different response 
characteristics. 

The configuration of Table 6-4 is that currently being simulated. 

To avoid problems due to the rate limitation discussed above, the 
gain of the good input to an actuator is doubled when the other input 
fails. 

(c) Parallel Mode Actuators. A study of hydraulic system allocation to 
the parallel mode actuators has not yet been accomplished. If a 
three-channel parallel mode were to be used, the series mode analysis 
would apply directly. If a four-channel mode should be selected, 
the DC-10 Automatic Flight Control System configuration would be 
directly applicable. 

6.1.4 RSSAS Autotrim. - As the aircraft flight path or engine thrust 
changes, the RSSAS will command a steady-state elevator for these new condi- 
tions. To allow a retrim of the series elevator position and reestablish the 
range of authority for the RSSAS series actuator, an automatic trim feature is 
necessary to reposition the horizontal stabilizer an amount equivalent to that 
being maintained by the elevator. The autotrim system designed for the RSSAS 
performs this function with the use of the existing DC-10-type rate actuator 
horizontal stabilizer trim system shown in Figure 6-24, replacing the alternate 
trim with the RSSAS input. 
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COMPUTER CHANNEL/HYDRAULIC SYSTEM 
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TABLE 6-4 

COMPUTER CHANNEL/HYDRAULIC SYSTEM 
FAILURE MODE EFFECTS 
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FIGURE 6-24. SYSTEM BLOCK DIAGRAM - HORIZONTAL STABILIZER TRIM 









The block diagram shown in Figure 6-25 is a combination of RSSAS and auto- 
trim concept. As the augmentor develops an elevator command, the threshold 
detectors sense this signal at Point A. The threshold detectors, in combina- 
tion with the time delays, are set to minimize stabilizer motion resulting 
from transitory augmentation commands. A typical threshold detector charac- 
teristic is shown in Figure 6-26. The ON threshold is set at the minimum level 
above the average expected elevator displacement. This average may be estab- 
lished by evaluation of the augmentation commands in various levels of turbu- 
lence and/or during selected aircraft maneuvers. The OFF threshold is set at 
a position about which the augmentor may function without immediately requiring 
stabilizer motion. The OFF level must, however, be established so that it can 
be achieved during all flight conditions. If not, the autotrim will continu- 
ously drive the stabilizer. Both levels of the threshold detector must also be 
variable to correspond to the effectivity of the elevator. The time delays - 
are set to complement the threshold detector such that transient elevator 
commands above the ON trim level do not result in stabilizer motion. The out- 
puts of the threshold detector/time delays are fixed discrete commands to the 
stabilizer's actuation system. 

The autotrim actuation consists of two dual electrohydraul ic valves and 
motors which operate at fixed equivalent rates summing to drive the stabilizer. 
One of the valves combines the primary pilot input with the augmentation trim 
and the other valve combines the primary pilot input with the autopilot trim. 

A single motor operates the stabilizer at half the rate of the two combined. 
Therefore, under normal operation the primary pilot trim operates at twice the 
rate of either of the other two trim functions. Table 6-5 summarizes these 
rates. If the two inputs to a valve are opposing commands, the associated 
motor will not drive. If the two motors are driving in opposite directions, 
the stabilizer will not move. 

To maintain consistent rates for the primary pilot trim function, the 
output of the threshold detector/time delays is inhibited as a function of 
pilot trim. Specifically, trim in the same direction is inhibited. In this 
way, the series elevator will not be retrimmed in a direction opposite to a 
pilot input which would effectively cut the pilot trim rate in half. Under 
all other conditions, the fixed RSSAS trim will be transmitted to the electro- 
hydraulic valve. As the stabilizer moves in response to this command, the 
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6-25. RSSAS BLOCK DIAGRAM WITH AUTOTRIM 










FIGURE 6-26. RSSAS AUTO TRIM THRESHOLD DETECTOR 


TABLE 6-5 

TRIM RATE SUMMARY 



TRIM RATE 


TRIM 

ABOVE 129 M/S 
(250 KN) 

BELOW 129 M/S 
(250 KN) 

MOTOR 

USED 

PRIMARY 

0.0035 RAD/S (0.2°/SEC) 

0.00873 RAD/S (0.5°/SEC) 

-1 AND -2 

RSSAS 

0.00175 RAD/S (0.1°/SEC) 

0.00436 RAD/S (0.25°/SEC) 

-1 

AUTOPILOT 

0.00175 RAD/S (0.1°/SEC) 

0.00436 RAD/S (0.25°/SEC) 

-2 


series elevator is repositioned an equivalent amount. Since the stabilizer 
position is a combination of all stabilizer commands, it is not used for this 
function. Instead, a model of the stabilizer motor provides the compensating 
signal which is summed with the series elevator command. 

The output of this model is also used in subtraction from total stabi- 
lizer position to determine all motion used for flightpath guidance. This, 
in turn, is summed with primary elevator control and provided as an input to 
the RSSAS control . 

Fault detection and isolation is an important consideration of the RSSAS 
trim function. Generally, two failure conditions can occur: (1) no trim 

action when required by the series elevator deflection, and (2) stabilizer 
motion does not agree with the elevator being off-loaded (i.e., the actuator 
model). Figure 6-27 expands the RSSAS autotrim diagram to include several 
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RSSAS FUNCTION 



STABILIZER TRIM ACTUATOR 


FIGURE 6-27. RSSAS BLOCK DIAGRAM WITH AUTOTRIM MONITORING 


















monitoring functions for these conditions. For the no-trim case, the C2 
comparator is set to recognize an abnormally high series elevator deflection. 
The Cl comparator in turn sums all the trim inputs to determine agreement 
with the total stabilizer position. A failed condition sensed by either 
comparator set activates a manual trim director and allows primary pilot 
inputs to the actuator model to off-load the series elevator. A single 
electrohydraul ic valve failure is also detectable by comparing the pilot 
trim input with the actual stabilizer rate at the actuator monitor null 
detector. Detection of mismatch at the null detector sets the model inputs 
to half value (half rate with only one valve operative). 

A production installation of such a system would require further study 
into the criteria for failure warning and latching/resetting of internal 
monitoring functions. Faults must be promptly recognized, reacted to, and 
indicated, but the intelligence of the system may require a self-healing 
process. The design shown is a combination of self-healing monitors and a 
single-latching comparator intended to shut down the autotrim function for 
gross disagreements of trim actuation and elevator off-load. 

6. 1.4.1 Alternate RSSAS Autotrim Mechanization. - Another RSSAS auto- 
trim mechanization considered was the use of a position (rather than rate) 
control system on the horizontal stabilizer with a fixed total travel capa- 
bility. This concept, developed for the initial DC-10, was to be used with 
a mach/airspeed trim compensator. Early in the DC-10 development program, 
it was determined that this augmentation was not required so the position 
stabilizer control valve was not installed on the production aircraft. 

This concept was not selected for the RSSAS, primarily for two reasons. 
First, a position system requires that the individual trim command of each 
FAC be synchronized or voted to establish a single stabilizer command. The 
resultant stabilizer position would then have to be fed back to the FACs 
in the correct proportion to the ratio of their desired displacement com- 
mands. An additional unit may be required to perform this trim drive. 

Second, and most significant, is the requirement that the RSSAS continuously 
control and position this actuation system properly for the flight regime. 

If the RSSAS is completely disengaged in flight and then subsequently 
engaged, the stabilizer actuation system may not be in the proper position 
to provide the range of stabilizer deflections necessary to off-load the 
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series elevator. This problem would not exist if the RSSAS was flight- 
crucial and it could be assured that full-time, continuous stabilizer control 
would be provided. 

6. 1.4. 2 Autotrim Operation. — The RSSAS autotrim function has been 
analyzed for various primary pilot and autopilot trim demands. Several of 
these operations are presented here using the simplified trim schematic 
shown in Figure 6-28. Figures 6-29 through 6-32 show the altitude, elevator 
commands, and trim response corresponding to selected maneuvers. The actual 
values used are arbitrary and have been selected for convenience and proper 
direction of response but not assigned an absolute signal level. In Case 1, 
Figure 6-29, the pilot inputs a pitch-up command with nose-up elevator. The 
pilot input (6 ) is in one direction and the augmentation input (s ) may 

move in the opposite direction to stabilize the aircraft response (e). After 
the appropriate time delay (TD) the augmentation trim command (<5 jq) turns on. 
The washout command (s^ D ) is summed with the augmentation command (6 c ) until 
the total (<$ es ) is zero and the trim command (<$ T q) turns off. While 6 TC was 
on, the stabilizer (a^y) was moving at a fixed rate and has now established 
the required new setting. When the pilot returns the aircraft attitude to 
the original condition, the trim process is reversed. 



TRIM 

FIGURE 6-28. AUGMENTATION TRIM SCHEMATIC 
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Figure 6-30 demonstrates a similar operation, but in this case the pilot 

has exercised his primary trim (6py) to off-load his elevator displacement 

(s ) prior to the operation of the augmentation trim. This leads to the 
e P .... 

next operational sequence with the pilot and RSSAS trim overlapping in time 

as shown in Figure 6-31. Note that the trim demands are in opposite 

directions, so the RSSAS trim-detector/time-delay output is not inhibited. 

If the trim demands were in the same direction, the RSSAS trim would be 

inhibited until the pilot trim is satisfied. The trim signals combine to 

turn off the upper control valve (CV) and the stabilizer runs at half rate. 

At the same time, the series elevator (6 gs ) is reduced by the washout 

command (<5 W g) and this combines with the stabilizer motion (s S y) to provide 

an aircraft response identical to that resulting from full stabilizer rate. 


The last example, shown in Figure 6-32, is the combined operation of 
autopilot and RSSAS trim responding to opposing commands. At time T-|, the 
autopilot trim (s^py) is initiated to off-load the autopilot elevator input 
Cse^yp). At time TD, the RSSAS trim (6y C ) turns on and, since the two trim 
commands are in opposition, the stabilizer motion (<$$y) stops. The two 
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FIGURE 6-30. AUGMENTATION TRIM - CASE 2 

elevator displacement commands (6e^ p and <$ es ) continue to wash out at 
opposite equivalent rates. When either command error is nulled, the cor- 
responding trim is turned off. In the example shown, the autopilot is 
satisfied first, and at this time the stabilizer begins to move in response 
to the existing RSSAS trim command. 

6.1.5 Integration of Other Augmentation Functions. - Several other 
functions were considered for integration, together with the RSSAS function, 
into the FAC. These additional functions include: 

• Yaw damping/turn coordination 

• Elevator-load-feel programming (ELF) 

• Flap-position limiting (FL) 
t Stall warning. 

Diagrams of the equivalent DC-10 systems are presented in Appendix 10. 
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There are two reasons for this integration. First, all of these 
functions are required for dispatch of the aircraft. Second, most of the 
required data to perform these calculations will normally be available to 
the RSSAS function. These signals include: 

• Yaw rate - attitude heading reference system 

• Roll attitude — attitude heading reference system 

• Airspeed — air data computer 

• Mach - air data computer 

t Angle of attack — angle-of-attack vanes. 
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Additional sensor signals necessary to be provided to the FAC include: 

• Flap position - FL and stall warning 

• VCK position - stall warning 

• Function-engage control — all functions 

• Servo/actuator commands and feedback - all functions. 
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The effect on the computer architecture and system reliability of 
incorporating these functions is discussed in Paragraphs 6.1 and 4.2, 
respectively. 

6.1.6 Electrical Power. — The EET basic aircraft flying qualities are 
such that an augmentor is not required for safety of flight. Thus, the 
augmentation system does not require a noninterruptable electrical power 
source, such as a battery. For this reason, a conventional electrical AC 
power system for the EET is acceptable. A description of the aircraft 
system is presented in Appendix 11. 

6.1.7 Maintenance Concept. - Maintenance is the function performed by 
the user of a system to place that system in proper operating condition. To 
assist in that function, most avionics systems incorporate a certain amount 
of maintainability. The thoroughness and accuracy with which a system 
performs this function depends on the capabilities of the individual com- 
ponents and the complexity of its interfaces. The motivation for improving 
this capability is the cost of maintenance or possible lost revenues, as in 
the case of dispatch critical functions. All the functions (RSSAS, Yaw 
Damping, Elevator-Load-Feel /Flap-Limiting, and Stall Warning) proposed for 
integration into the FAC are in fact required for dispatch. Therefore, a 
complete and comprehensive built-in maintenance capability is desired. The 
three major tasks that this FAC maintenance function must perform are: 

(1) Fault Detection, (2) Fault Isolation, and (3) Functional Verification. 

6. 1.7.1 Fault Detection. — Fault detection is mostly performed con- 
tinuously in flight by the system's monitors. Each FAC, of course, uses the 
data to make on-line control and/or configuration decisions. The data must 
also be transmitted to a central system maintenance unit and stored in a 
nonvolatile memory for subsequent recall. For the ground condition, a 
manually initiated, automatic test is required, which stimulates the system 
so that the monitors can perform their functions. 

6. 1.7. 2 Fault Isolation. — The on-line system monitoring is primarily 
designed to isolate a fault to a function. In most cases, the fault is also 
isolated to a component failure or interface. Some faults, however, are not 


195 



easily isolated, such as different faults which produce the same effects. 

For these cases, the ground maintenance function must have the capability to 
sequentially stimulate the individual system elements. In other cases, an 
unusual combination of environmental conditions or control requirements may 
be the stimulus for the fault. Here the recorded data must be maintained 
and, upon recognition of the conditions or by recurrence of the event, the 
fault diagnosed. 

6. 1.7. 3 Functional Verification. — There are two levels of functional 
verification of the system. The most complete is that verification necessary 
after installation of a system component - primarily a FAC. Using the central 
maintenance unit, all functions influenced by the newly installed component 
must be tested by the maintenance personnel for proper operation, including 
some level of performance capability. Besides being a function test, this 
procedure verifies the system to the component level. The other functional 
verification occurs during a normal preflight cockpit check and is performed 
by the flight crew. In this case, the maintenance unit is not used, but 
rather the test is initiated at the location of the normal cockpit controls 
for the function. Each function can be individually tested or performed as 
part of an integral test, depending on the cockpit layout and/or operation 
philosophy. The preflight test is intended to be solely a functional check, 
and verification to the flight crew is at a functional level. 

To isolate a fault or verify a function while on the ground requires 
the capability to stimulate the sensors to known conditions. The FACs will 
in turn verify the sensor data, perform the necessary calculations for each 
of its functions, and provide an appropriate actuator command output. The 
actuation systems are checked by verifying the correct feedbacks. (Stall 
warning requires observation of the stick shaker.) All units of the FAC 
functions will have this capability. 

6. 1.7. 4 The Maintenance Unit. — The maintenance unit is an integral 
part of the flight augmentation system design. It must interface with all 
FACs to issue maintenance test instructions and to interrogate the computer 
function. A single maintenance unit may perform the same function for other 
avionics systems such as the flight guidance systems (autopilot and flight 
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director), flight management systems (navigation and flight performance), 
and/or thrust management systems (autothrottle and thrust-rating). To assure 
that the maintenance unit does not become the limiting factor in the maintain- 
ability of these systems, a simple reliable device is required. The proposed 
unit would include a test-initiate pushbutton, a go/no-go annunciator, and 
select switch to allow individual system test or varying levels of functional 
test, depending upon the maintenance action required or aircraft configuration 
(hydraulic power available or surfaces locked). It is suggested that a 
microprocessor be included in the unit, with nonvolatile memory, to perform 
the necessary test data management and to record the inflight and test data. 

A multicharacter display also would be provided to convey the detailed 
performance information to the maintenance operator. The display also would 
be used by the system to request the maintenance operator to make aircraft 
configuration changes, verify display presentation, or to perform other 
functions not available to the maintenance unit. Verification or nonverifi- 
cation of the requested task would be signified through separate pushbutton 
inputs. 

Due to the interaction of the maintenance unit and operator, it is 
suggested that the unit be located in the cockpit, convenient to the 
necessary aircraft, controls and displays. A remote parallel unit may be 
considered for the avionics equipment compartment. 

The maintenance unit required to perform these functions is similar to 
the DC-9 Series 80 Digital Flight Guidance System Maintenance Panel shown 
in Figure 6-33. 

6. 1.7. 5 Preflight Tests. - The preflight tests of the augmentation 
system functions are initiated by the flight crew at the normal control 
location on the forward overhead control panel. The test-initiate signal is 
provided directly to the FAC which in turn sequences the proper system stimuli 
to verify the selected function. Initiation of the test will cause the 
appropriate function warning light to illuminate. Besides indicating the 
test in progress, this serves as a test of the warning light circuits. At 
the conclusion of the test, the warning light will extinguish if the 
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• PREFLIGHT /SEMIAUTOMATIC 

• MAINTENANCE TESTING 

• RECALL OF INFLIGHT FAILURES 

8-DC9-91562 

FIGURE 6-33. DC-9 SERIES 80 MAINTENANCE PANEL 
function is satisfactory, but will remain illuminated if a fault is detected. 
The test results will also be monitored by the maintenance unit which may 
receive detailed component failure characteristics. Figure 6-34 shows the 
overhead instrument panel layout with appropriate augmentation function 
controls. 

6.1.8 Fly-by-Wire Considerations. — The fly-by-wire (FBW) concept can 
be implemented as either hybrid nonflight crucial or as the total primary 
flight controls. The hybrid mechanization would require some level of 
mechanical capability as a backup to the electronic control, but the total 
system would not require such backing. 

At first, FBW seems like an ideal candidate for integration with the 
RSSAS due to its high reliability and architecture (primarily actuator inter- 
face). After some consideration, however, many differences become apparent 
and these require significantly different design approaches. Some of these 
items are discussed below. 

6. 1.8.1 Reliability and Safety. - The loss of the RSSAS function must 
-5 

meet a 1x10 regulatory failure probability criterion, as interpreted in 
Figure 4-7, for a basic aircraft with Level 2 flying qualities which can 
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FIGURE 6-34. OVERHEAD PANEL PREFLIGHT TEST CONTROL 


complete its mission or flight plan. The electronics of a hybrid FBW would 

-7 

probably have to satisfy the 1x10 probability requirement since the flight 
plan would be aborted with an immediate landing. This is a result of having 
only a single-string mechanical control system available, which may be a 
single failure away from loss of aircraft control. The full electronic FBW 
would, of course, require a maximum system failure probability of less than 
lxlO - ^. Dispatch inoperative considerations would require an even greater 
level of redundancy than that required to meet the safety criteria. 


• 6. 1.8. 2 Flying Qualities. - While the RSSAS is provided to maintain 
flying qualities, the FBW mechanizations are primarily a replacement for 
complex and heavy mechanical components. 
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6. 1.8. 3 Sensors. - The RSSAS requires several different types of 
aircraft sensors to describe the aircraft control and response. The FBW 

systems require only some type of pilot control sensors (control wheel or 
side-stick force or position), to determine the desired pilot input. 

6. 1.8. 4 Computation. — The RSSAS function requires the processing of 
many inputs, a complex computation and logic operation, and a large degree 
of monitoring of different devices. The FBW function is a rather simple 
calculation with the minimum sensor input. Monitoring must be complete, 
but the task is relatively simple. The FBW systems will require control of 
many actuators (more than RSSAS) and, to keep the computation system simple, 
a fully monitored closed servo loop at each of these actuators may be 
required. 


6. 1.8. 5 Actuation. — Static stability augmentation is accomplished 
through series elevator actuators which do not reflect back into the pilot 
control. The traditional commercial transport has used control systems 
which reflect the position of the control surfaces. For the hybrid FBW, 
this can be accomplished by using a parallel actuator at the surface and 
allowing this actuator to back-drive the control wheel/column through the 
backup cable system. The full electronic FBW would have no way of driving 
the control wheel /column through a mechanical system so that the surface 
actuator could be shared with other functions such as RSSAS. Either the 
control wheel /column would not be required to display the control surface 
position, or a separate actuator package would have to be installed at the 
pilot's position to move the control input in parallel with the surface. 

6. 1.8. 6 Electrical Power. — Unlike the RSSAS, the FBW mechanization 
cannot be allowed to disconnect (even a temporary disconnect of the hybrid 
system would be a nuisance); therefore, a noninterruptible power source is 
required. The full electronic FBW requirement of the electrical system is 
more severe than any present electrical system requirement. 

6.2 Architecture Formulation 

Architecture formulation consists of defining the individual elements 
of the system, their level of redundancy, and the interconnection of the 


200 



devices. Based on individual design constraints and functional independence, 
it has been decided that the configurations for the relaxed static stability 
augmentation, pitch/thrust compensation, and automatic trim for the series 
elevator augmentation would be developed independently. Formulation of the 
relaxed static stability augmentation architecture has been initiated by first 
establishing the most demanding functional reliability requirements of the 
system. As shown in Figure 6-35, this can be based on the interpretation of 
the regulatory requirements, desired functional availability, or other criteria 
based on knowledge of, or experience with, such systems. In the reliability 
and safety section of this report, the regulatory requirement for the loss of 
augmentation for an aircraft with Level 2 flying qualities has been interpreted 
to specify a total RSSAS function failure probability of approximately IxlO" 5 
for one flight hour. The desired functional availability of the RSSAS is 
based on traditional capabilities of similar augmentation devices such as yaw 
damping. This allows one complete system loss per year for a fleet of 200 
aircraft, each operating 1000 hours per year. This equals a failure rate of 
2.5x10"® failures/hour. The path through the design contingencies anticipates 
that as the aircraft aerodynamic definition progresses, it may be determined 
that there are isolated aircraft/envelope combinations in which the 
unaugmented aircraft flying qualities degrade to a Level 3. The regulatory 
requirements would then specify a total RSSAS failure probability 1 xl 0“7 -j n 
these flight regimes. This most restrictive system failure probability has 
been established as the reliability requirement of the study. It is antici- 
pated that this target, besides providing a margin for the specified flying 
qualities, will allow flexibility in operating and maintaining this dispatch- 
critical system. 

The relaxed static stability augmentation has been partitioned into 
functional subsets as shown in Figure 6-36. These subsets include: (1) the 

sensors along with the data transmission to the computation; (2) the computa- 
tion accepting the data input and providing control commands to the actuators, 
and (3) an actuation system which interfaces with the primary controls to 
drive the elevator surfaces and is powered by the hydraulic system. The 
existing conventional electrical system was assumed to be used for the power 
source and is described in Appendix 11. 
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• SAFETY 

- INTERPRETATION OF REGULATORY 
REQUIREMENTS 

1 x TO' 5 SYSTEM FAILURES/FLIGHT HOUR 


TRADITIONAL FUNCTIONAL AVAILABILITY 

- ALLOW ONE TOTAL SYSTEM LOSS 
PER YEAR FOR A 200-AIRCRAFT 
FLEET WITH EACH AIRCRAFT 
OPERATING 2000 HOURS PER YEAR 

2.5 x 10' 6 SYSTEM FAILURES/FLIGHT HOUR 


T 


• DESIGN CONTINGENCY 

- COMBINATION OF AIRCRAFT AND 
FLIGHT ENVELOPE WHERE LEVEL 3 
FLYING QUALITIES ARE EXHIBITED 

1 x 10' 7 SYSTEM FAILURES/HOUR 

FIGURE 6-35. ARCHITECTURE FORMULATION RELIABILITY CONSIDERATIONS 


3 x 10 


1-8 


Q = 4 x 10 -8 





ELECTRICAL SYSTEM Q = 3x10 8 
Q = FAILURE PROBABILITY 


FIGURE 6-36. RSSAS FUNCTIONAL PARTITION AND RELIABILITY ASSIGNMENT 
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Using this partitioning of function, the specified reliability has been 

allocated to the individual subsets proportionately to that system reliability 

experienced on the DC-10. As shown in Figure 6-36, the sensor system prob- 

-8 

ability goals is 3x10 and the combined computer/actuation subsets goal is 
-8 -8 

4x10 . The remaining 3x10 is allocated to the electrical system and any 

control devices. The computation and actuation subsets have been combined 
since an individual actuator system has a significantly lower failure proba- 
bility than its corresponding computer drive, and the associated computer 
failure nearly always results in loss of the corresponding actuator control. 
This dependence of the actuation on the computation justifies combining the 
reliability requirement into a single subsystem goal. 

Figure 6-37 is a system redundancy graph that relates the single system 
MTBF to the number of systems required to achieve a failure probability of 
IxlO" 7 for one hour. All failures are assumed to be detected and isolated. 

This gives a first approximation of the level of redundancy needed in con- 
structing a system architecture. For the partitioning assigned, this graph 

-8 -8 

could have been constructed more accurately for the 3x10 and 4x10 failure 
probabilities of the subsystems. Based on avionics hardware experience which 
has shown typical component MTBF's in the 3000- to 5000-hour range, a redun- 
dancy level of two to no greater than three appears to satisfy the reliability 
requirement. In actuality, the curve differs from that shown when considera- 
tion is given to effects of failure modes and fault detection, isolation, and 
reconf i gurati on capabi 1 i ti es . 

6.2.1 Sensor Array 

6. 2. 1.1 Initial Component Redundancy Evaluation. - Prior to determination 
of acceptable control laws, a sensor reliability analysis was performed, assum- 
ing only a single control law capability would be attained. The failure prob- 
abilities of the sensor array related to each of the original 28 possible 
control law configurations have been calculated for various levels of component 
redundancy. This provides an insight into the sensor redundancy and/or sensor 
monitoring confidence required to satisfy the allotted failure probability of 
3xl0" 8 . 
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SINGLE SYSTEM MTBF (HOURS) 



1 2 3 4 5 6 7 8 

NUMBER OF SYSTEMS REQUIRED 

FIGURE 6-37. SYSTEM REDUNDANCY REQUIRED 


Subsequent control law development has demonstrated that several control 
laws, each based on a unique sensor array, provide satisfactory augmentation. 
This allowed the use of a method of control law reversion (discussed in 
Paragraph 6. 2. 1.2) to meet the reliability criteria for sensor failures 
rather than "bulk sensor redundancy". A technique for selection of the 
required level of redundancy and monitoring for "bulk sensor redundancy" 
is presented in this section only as an example for the reader and was 
not used in the selection of the final system architecture. 
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Calculations have been made for redundancy levels of two, three, and four 
sensor systems. The MTBFs used for the various sensors are based on historical 
data available from DC-10 experience. These MTBFs are 3200 hours for the 
Vertical Gyro (e), 6000 hours for the Air Data Computer (u, h), 12,000 hours 
for the Accelerometer Unit (A w , A ), and 3000 hours for the Angle-of- Attack 
Sensor (a). Since there is no DC-10 sensor for pitch rate (e), a MTBF of 
5000 hours has been assigned; this value should be realistic whether the device 
is added circuitry to derive pitch rate from pitch attitude, or a separate rate 
sensor installed on the aircraft. 


The study has assumed that the sensor-monitoring function would be such 
that with three or more operative units, a single failure would be detected by 
comparison-monitoring, isolated, and removed with 100-percent confidence. With 
two operative units of the same type, a failure would be detected by comparison- 
monitoring with 100-percent confidence but isolated and removed (such that the 
remaining unit can continue to operate) with a confidence factor, C, related 
to the capability of in-line monitoring of an individual sensor's data. Of 
course, when operating with a single-type sensor unit, all failures result in 
loss of function regardless of failure-detection capability. In the calcula- 
tions performed, the confidence factor, C, is not assigned, but rather deter- 
mined so that the reliability criteria are satisfied. 


The reliability of the individual sensor units is R $ = e" xt and the 

probability of failure is Q = 1 - R = 1 - e“ At . With At very small, 

-At ^ ^ 

Q - 1 - e « xt. For a dual -sensor- type redundancy, the probability of total 

function failure due to the sensors, Qr , is approximately the probability of 

2 

failure of both devices of a type, Q^, plus the probability of a failure in 
either single unit that can only be isolated at a probability of C, 2 (1 - Cy) 
Q S y This gives the equation: 



2 to 
T=1 5 T 


+ 20 - 


where Cy = confidence of in-line fault detection and isolation of sensor 
type T . 
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In the triple redundancy sensor arrays, the probability of failure, Qp c , 

2 ^ 

is approximately the probability of failure of all devices of a type, C^, plus 
the probability of two devices of a single type failing where the second failure 
can only be isolated at a probability of C, 3(1 - Cj)Qc^.. This gives the 
equation: 



N 3 2 

2 Qo + 3(1 - C t )C£ 
T=1 a T 1 T 


With quad-sensor redundancy, the probability of failure, Qp , is approximately 

4 ^ 

the probability of failure of all devices of a type, Q^, plus the probability 
of three devices of a type failing where the third failure can only be isolated 
at a probability of C, 4(1 - CyJ.Qg . This gives the equation: 



N 

2 

T=1 


+ 4(1 - c T )q| 


The value of C has been calculated by setting Qp^ = 3xl0~ 8 . For those 
control laws with more than one sensor, C has been determined by allocating to 
each sensor type an equal probability of sensor function shutdown due to incom- 
plete in-line monitoring of individual sensors (C < 1). As an example, for a 
triple-redundancy, three-sensor- type array: 



3 

2 

T=1 



+ 3(1 - C T )Q| 

I 5 t 





+ 3(1 - C^Ql 


+ 3(1 - C 2 )Q| + 3(1 



Equalizing the effect of the unmonitored failure terms gives: 


3(1 - = 3(1 - C 2 )Q| = 3(1 - C 3 )q| 

3 x 10" 8 - Q? - Q? - Q 8 

^3 

3 
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Solving for the confidence terms gives: 



The required confidence level (or probability) of isolating faults with 
in-line monitoring for each sensor type is thus proportional to the probability 
of failure of the device. The higher the failure probability, the greater the 
necessary confidence that these failures will be isolated with in-line 
monitoring. 

The results of the evaluation are presented in Table 6-6. For each of 
the candidate control law configurations, the following data is presented: 

Qp s ( C 1 S = 100%) - failure probability of function with the confidence of in-line 
monitor fault detection and isolation set to 100 percent; Qp^ (C'S = 0) - 
failure probability of function with zero confidence of in-line monitor fault 
detection; and then the calculated required confidence factors of each sensor 

O 

element to achieve the desired 3x10 failure probability. In most cases the 

dual -redundant sensor array does not give the desired value of reliability even 

if the in-line monitoring detected and isolated 100 percent of all sensor 

failures. The triple-redundant sensor array exceeds the requirement for a 

100-percent confidence factor and usually needs an in-line monitor confidence 

"8 

in excess of 90 percent to achieve the 3x10 failure probability. The quad- 
redundant sensor array would have sufficient reliability to achieve the desired 
value with zero-percent failure detection and isolation of an in-line monitor. 


207 



EFFECT OF 



10 (tf.tf, a x .M) 




Q fs (C'S = 100%) 

1.724 x 10 7 

4.373 x 10 11 

1.196 x 10 14 

Q ps (C'S = 0%) 



1.749 x 10~ 10 

C » 


97 .44% 


C 0 


93.76% 


C ax 


64.05% 


C 


91.01% 














EFFECT OF 


TABLE 6-6 

SENSOR REDUNDANCY (CONTINUED) 


CONTROL LAW 


16 { 0 , 0 , hi 


TWO THREE 

SENSORS SENSORS 


FOUR 

SENSORS 


17 la x' a iV |U ' h) 
Q ps (C’S = 100%) 


18 (a , a , h) 
x n 



6. 2. 1.2 Alternate Sensor Configuration Flexibility. - The large number of 
acceptable control laws identified and verified using different sensor combi- 
nations provide considerable flexibility in reconfiguring the control law as a 
result of sensor failures. A reconfigured control law has a sensor combination 
that is a subset of the original (maximum) sensor array. Figure 6-38 shows 
the control law flexibility with sensor failures that allow reconfiguration to 
other available sensor sources. This type of control law reversionary scheme 
results in increased augmentation system availability without requiring addi- 
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FIGURE 6-38. CONTROL LAW FLEXIBILITY 

tional sensor hardware redundancy. The strategy followed is to operate with 
the control law having the highest-level sensor array (most unique parameters), 
thereby keeping all signals in the active computation rather than in a standby 
mode. If a sensor fails, the system is reconfigured, using the control law 
with the next highest sensor array. 

6.2.2 Computer Architectures. - The computer architecture analysis con- 
siders a system which performs only the RSSAS function and a system which also 
performs the other augmentation functions described in Paragraph 6.1.5. The 
analysis evaluates and compares the reliabilities of each system. 

In a digital computer, a large part of the total failure rate is inde- 
pendent of the functions performed. The processor, A/D converter, I/O control, 
and general purpose routines in memory are required regardless of the number 
of functions. Thus, memory growth as functions are added is minimal. The 
computer memory distribution is estimated for this study as: 
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60 percent 
15 percent 
10 percent 
6 percent 
9 percent 

Figure 6-39 shows the computing subsystem elements. The basic system 
elements and their failure rates are given below. These element failure rates 
are independent of functions performed. 


Basic System XxlO -6 

Processor and Memory = 28.4 

Bus Interface and Control = 21.3 

Power Supply = 8.3 

A/D Converter and Control and MUX = 25.4 

I/O Discrete and Output Control = 12.7 

Total 95.9 


The failure rate (in hours) for each function has then been determined 
assuming that static stability augmentation is first provided. Table 6-7 shows 
assignment of memory failure rate to the required analog and discrete inputs 
and outputs for each function. The total is 340.9x10 failures per hour 
including the basic system. 

If the augmentation functions were to be provided by a separate digital 
computer, the basic core elements, as well as several data interfaces, must be 
added to each function as shown in Table 6-8. When these are added together, 
the total system failure rate is significantly higher as shown below: 


Basic System 

Static Stability Augmentation 
Yaw Damper/Turn Coordination 
ELF/FL 

Stall Warning 


Stability Augmentation 238.5 
Yaw Damper 198.7 
EFL/FL 192.9 
Stall Warning 130.9 


Total four independent units 


761x1 0" 6 


failures per hour 
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For subsequent calculations. 


the following FAC failure rates are used 


FAC with RSSAS only 

FAC with all augmentation functions 


250x10 failures per hour 

340x10 failures per hour 



ALL \’S ARE IN FAILURES PER MILLION HOURS 


FIGURE 6-39. COMPUTER SUBSYSTEM ELEMENTS AND FAILURE RATES 
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TABLE 6-7 

INTEGRATED FUNCTION RELIABILITY SUMMARY 



COMPONENT 

VALUE 

STABILITY 

AUGMENTATION 

YAW DAMPER 

ELF/FL 

STALL WARNING 


(EACH) 

(NO.) 

Xx 10 -6 

(NO.) 

Xx 10 -6 

(NO) 

X x 10 -6 

(NO.) 

X x 10" 6 

MEMORY 


(0.15) 

5.1 

(0.10) 

3.4 

(0.06) 

2 

(0.09) 

3.1 

SERVO AMPLIFIER 

3.0 

(2) 

6 

(2) 

6 





AC INPUT 

2.91 

(13) 

37.8 

(6) 

17.5 

(6) 

17.5 

(1) 

2.9 

DC INPUT 

1.0 

(5) 

5 

(2) 

2 





DISCRETE INPUT 

0.11 

(4) 

0.5 

(8) 

0.9 



(5) 

0.6 

DISCRETE OUTPUT 

1.0 

(10) 

10 

(17) 

17 

(4) 

4 

(8) 

8 

DC OUTPUT 

1.2 

(2) 

2.4 







TRANSMITTER AND 
MULTIPLEXER 

16.5 

(1) 

20.9* 







RECEIVER AND 
MULTIPLEXER 

10.0 

(5) 

54.4* 







POWER SERVO AMPLIFIER 
PLUS POWER SUPPLY 

6.0 





(2) 

18** 



TOTAL 



142.1 


46.8 


41 .5 


14.6 


‘CONSTANT X x 1 0 ® OF 4.4 ADDED TO THESE SUBSYSTEMS. 
“CONSTANT X x 10~ 6 OF 6.0 ADDED TO THIS SUBSYSTEM. 
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TABLE 6-8 


INDIVIDUAL FUNCTION RELIABILITY SUMMARY 



COMPONENT 
VALUE 
\ x 10~ 6 
(EACH) 

STABILITY 

AUGMENTATION 

YAW DAMPER 

ELF/FL 

STALL WARNING 


(NO.) 

Xx 10 -6 

(NO.) 

X x 10 -6 

(NO.) 

X x 10~ 6 

(NO.) 

AxlO -6 

BASIC CORE 



95.9 


95.9 


95.9 


95.9 

MEMORY 



5.6 


3.7 


2.2 


3.3 

SERVO AMPLIFIER 

3.0 

(2) 

6 

(2) 

6 





AC INPUT 

2.91 

(13) 

37.8 

(6) 

17.5 

(6) 

17.5 

(3) 

8.7 

DC INPUT 

1.0 

(5) 

5 

(2) 

2 





DISCRETE INPUT 

0.11 

(4) 

0.5 

(12) 

1 '3 



(5) 

0.6 

DISCRETE OUTPUT 

1.0 

(10) 

10 

(17) 

17 

(4) 

4 

(8) 

8 

DC OUTPUT 

1.2 

(2) 

2.4 







TRANSMITTER AND 
MULTIPLEXER 

16.5 

(1) 

20.9? 

(1) 

20.9* 

(1) 

20.9* 



RECEIVER AND 
MULTIPLEXER 

10.0 

(51 

54.4* 

(3) 

34.4* 

(3) 

34.4* 

(1) 

14.4* 

POWER SERVO AMPLIFIER 
PLUS POWER SUPPLY 

6.0 





(2) 

18* * 



TOTAL 




238.5 


198.7 


192.9 


130.9 


‘CONSTANT X x 10~ 6 OF 4.4 ADDED TO THESE SUBSYSTEMS. 
“CONSTANT X X 1 0“ 6 OF 6.0 ADDED TO THIS SUBSYSTEM. 


6.2.3 Sensor Computation Architectures. — Several alternative methods of 
transmitting data from the fixed DC-10- type sensor set to the computational 
elements have been considered. Shown in Figure 6-40, they include: (1) direct 

single sensor to corresponding computer signal conditioning data processor 

(SCDP); (2) data crossfed from each sensor to all computer SCDPs and between 

) 

all computers; (3) data crossfed from each sensor to all computer SCDPs; and, 
(4) data crossfed between all computers. 

Each of these methods was in turn coupled with triple- and dual -redundant 
computer configurations to form the architectures shown in Figures 6-41 to 
6-43. All computers are assumed to be internally fully monitored either by 
in-line self- testing (triple computer configurations in Figure 6-41 and dual 
computer configuration in Figure 6-42), or by comparison of dual hardware 
channels (dual computer configuration in Figure 6-43). For the triple 
computer configurations in Figure 6-41, a direct dedicated sensor connection 
to each SCDP (Figure 6-40, configuration 1) is not possible since several of 
the sensor types (a, A n , u, li) are of a dual level of redundancy while the 
computers are triple-redundant. The sensors must therefore interface with 
more than single SCDP as in configurations 2 and 3 or the data must be cross- 
fed between CPU's, as in configurations 2 and 4. 

A reliability evaluation has been made of these candidate architectures 
using the DC-10 sensor failure rates previously listed in Paragraph 6. 2. 1.1 
and the following representative computer reliability values, based on the 
previous computer discussion: 

Computer MTBF 

• Single-Channel 4000 hours 

Full In-Line Monitor 

• Dual -Channel 3200 hours 

Comparison-Monitor 

The corresponding internal function failure rates used are: 

• SCDP 62.5x10"^ failures/hour 

(both type computers) 

• Remaining Electronics 

- Single-Channel Type 187. 5x1 0" 6 

- Dual -Channel Type 125xl0”^/channel 
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SENSORS COMPUTATION SENSORS. COMPUTATION 



CONFIGURATION l\IO. 1 CONFIGURATION NO. 3 


♦DUAL AND TRIPLE REDUNDANT COMPUTATION EVALUATED 


SENSORS COMPUTATION SENSORS COMPUTATION 



CONFIGURATION NO. 2 CONFIGURATION NO. 4 


8-GEN25944 

FIGURE 6-40. SENSOR/COMPUTATION INTERFACE - ARCHITECTURE FORMULATION 

The results of the reliability calculations for each combination of com- 
puter, data transmission, and control law are summarized in Table 6-9. The 
probability of function loss calculated for each sensor combination assumes 
that all sensor subset combinations are also available and can provide satis- 

factory performance. As an example, the eectu control law failure probability 
• • • 

includes the ee, a, u, eea, eeu, and au control laws and requires that all of 

these fail for loss of function. The allocated probability of failure for this 

-8 

portion of the system is 3x10 , therefore, all sensor combinations which do 

not exceed this probability limit describe a successful family of control 
laws. The combinations which do not satisfy the criteria are shown shaded in 
Table 6-9. (Note that the No. 1 method of data transmission was determined to 
exceed the probability limit and was not calculated for all combinations.) 

This table also shows the predominant contributor(s) to the failure probability, 
which can be the sensors (S), the computer SCDP (SC), the remaining computer 
function (CP), or the total computer (C). Probabilities are for one hour. 

4 

These data indicate that either triple- or dual -redundant computers, and 
several sensor families, can satisfy the reliability criteria. The sensor data 
must, however, be crossfed between the sensors and the computer. Use of the 
computer crosstalk data bus to crossfeed sensor cannot in itself satisfy the 
sensor data transmission requirements, but can be used to improve the data 
availability. 
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FIGURE 6-42. DUAL COMPUTER CONFIGURATION - SINGLE PROCESSOR 
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FIGURE 6-43. DUAL COMPUTER CONFIGURATION 
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TABLE 6-9 

SENSOR/COMPUTATION INTERFACE - RELIABILITY ASSESSMENT 


i * so ' 7 s «: 


2 * W-' $ SC 


9 * 10 : 


a X ao * 4 sc 


\ * a <r sc 


4 I 10* 9 SC 

.g 

4 x 10 * SC 
« x ]0' 9 SC 

1 x !0* 7 C 
1 x 10' 7 C 
1 x 10* 7 C 

. .7 _ 

4 x 10 * SC 

1 x 10 C 

4 x I0' 9 SC 

1 x 10* 7 C 

4 x 10" 9 SC 

1 x 10' 8 C 

4 x 10' 9 SC 

1 i 10‘ 7 c 

4 x 10' 9 SC 

1 x 10* 7 c 

. ■ ... 


6 x 10* 7 S 

8 x ifl* 7 S 

t x ID* 7 S 

3 x Kf 7 S 

3 x la* 9 s 

3 x 10'* S 




6.2.4 Computer/ Actuation and Total System Architecture. — The computer- 
actuator configurations shown in Figures 6-44, 6-45, and 6-46 have been sug- 
gested as the architectures to interface with the sensor arrays concluded as 
successful in Paragraph 6.2.3. These configurations are based on dual- and 
triple-redundant computers interfacing with the DC-10- type split surface 
arrangement, using either two or four of the elevator segments (at least one 
surface on each side of the vertical tail). In addition, several of the con- 
figurations use dual series input actuators, allowing multiple computer control 
of a single elevator surface. The appropriate hydraulic system inputs to the 

series actuators have also been considered. The failure rates used for the 

-3 -3 

actuation system are actuator = 0.02x10 and hydraulics = 0.09x10 failures 
per hour. 



CONFIGURATION 2 



CONFIGURATION 3 CONFIGURATION 4 



C - RSSAS FAC 

A - SERIES ELEVATOR ACTUATOR 
H - HYDRAULIC SYSTEM 


FIGURE 6-44. TRIPLE-REDUNDANT COMPUTER/ACTUATOR CONFIGURATIONS 
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CONFIGURATION 1 


CONFIGURATION 2 



CONFIGURATION 3 


CONFIGURATION 4 



CONFIGURATION 5 



C - RSSAS FAC 

A - SERIES ELEVATOR ACTUATOR 
H - HYDRAULIC SYSTEM 


FIGURE 6-45. DUAL-REDUNDANT COMPUTER/ACTUATOR CONFIGURATIONS 
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CONFIGURATION 1 


CONFIGURATION 2 



CONFIGURATION 3 CONFIGURATION 4 



FIGURE 6-46. DUAL-DUAL COMPUTER/ACTUATOR CONFIGURATIONS 
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Table 6-10 is a summary of reliability calculations for the combined 
sensor, computer, and actuation architectures. For each combination of 
computer/sensor and computer/actuator configuration, a probability of loss-of- 
function is provided for each successful sensor array. Also provided is an 
indication of the predominant contributor to the failure which can be the 
sensors (S), the computers SCDP (SC), the total computer (€), the actuator (A), 
or the hydraulics (H). 


From the data presented in Table 6-10, it is concluded that all configura- 
tions except Dual No. 1 computer/actuator satisfy the allotted probability of 

O 

function loss of approximately 7x10 for one hour. 

6.2.5 Candidate System Selection. — Several; considerations enter into the 
final selection of the system architecture. It has previously been established 
that all sensor data must be crossfed to all computers. In addition, it is 
recognized that all computers must talk with each other with regard to control 
law selection, failure reversion, and probably even trim and normal augmenta- 
tion control. Since an intersystem communication link is required, it should 
be used additionally to crossfeed sensor data. Also, while the system must 
satisfy the reliability design requirements, too much redundancy or complexity 
of interfaces is usually costly in terms of higher system purchase price and/or 
lower total system maintenance MTBF, which is reflected in higher maintenance 
costs. With these two considerations in mind, Figure 6-47 shows several sensor 
arrays combined with triple- and dual -redundant architectures as a function of 
their reliability potential. The legend in Figure 6-47 defines the level of 
computer redundancy, computer/actuation configuration, and sensor/computation 
interface. As an example. Triple 1.2 indicates triple-redundant computer/ 
actuation configuration 1 (Figure 6-44) combined with sensor/computation 
configuration 2 (Figure 6-41). 

As previously discussed, several other augmentation functions are candi- 
dates for integration into the FAC. This would result in lower computer MTBF 
and would effectively move all of the configurations shown in Figure 6-47 
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TABLE 6-10 

SENSOR/COMPUTER/ACTUATOR RELIABILITY SUMMARY - 
TRIPLE-REDUNDANT COMPUTERS 


COMPUTER/ 

ACTUATOR 

INTERFACE 

CONFIGURATIONS 

COMPUTER/SENSOR INTERFACE CONFIGURATIONS 

TRIPLEX CONFIGURATION 2 

NO.1 

M, <*, 9, 9 

NO. 12 

e ' 0 'Vh 

# NO. 13 

9,6, A n , a 

# NO. 14 

9.9,A N ,fi 

NO. # 15 
8. e.h.v 

NO. 3 

a, 6,6 

NO. 4 

U.,6,6 

NO. 16 

0,0, h 

NO. 29 
9.6. 

NO. 27 
A. 9 

NO. 30 

a n ,m 

NO. 31 

v h * 

NO. 32 

V* 

NO. 26 
a n 

TRIPLE 1 

12@® 
x 10 8 

120® 
x 10 8 

1.20® 
x 10“ 8 

12 ®® 
x 10“ 8 

1.2®® 
x 10“ 8 

1.2®® 
x 10“ 8 

1.2 @®. 
x 10“ 8 

1.20® 
x 10 8 

1.20® 
x 10 -8 

1.20® 
x 10“ 8 

1.20® 
x 10“ 8 

1.20® 
x 10“ 8 

1.20® 
x 10 8 

1-9®©® 

x 10 * 

TRIPLE 2 

1.9©@® 
x 10“ “ 

1.9©0® 
x 10 “ 

1.900® 
x 10““ 

19©0® 

x 10““ 

2.7© 
x 10“ 10 

5.1© 
x 10 -10 

2.7© 
x 10- 10 

2.7© 
x 10 10 

1.9©0® 

x 10 _ “ 

2.7© 
x 10“ 10 

2.1©00® 
x 10-“ 

2.1©00® 
x 10 -11 

2.-1©©®® 
x 10 _ “ 

7.0© 
x 10^ 

TRIPLE 3 

8.1 ©0® 

x 10 12 

8.O©0® 

x'10“ 12 

8.0@@© 
,~=12 
x 10 

8O©0® 
x 10~ 12 

2.5© 
x 10“ 10 

5.1© 

XIO- 10 

2.5© 

x10“ 10 

2.5© 
x 10- 10 

7.9© 
x 10 — 12 

25© 
x 10“ 10 

1.00© 
x 10““ 

1.0©© 
x 10 -11 

1.2©© 
x 10 11 

7.0© 
x 10 -9 

TRIPLE 4 

81 ©0® 
x 10 — 12 

8,O©0® 

x1(T“ 

8.O©0® 

x 10 -12 

x a> 
Jvoy 

2.5© 
x 10- 10 

5.1© 
x 10“ 10 

25© 
x IQ- 10 

2.5© 
x 10 -10 

7.9© 
x 10" 12 

2.5© 
x 10“ 10 

19©© 
x 10 11 

1.0©© 
x 10 11 

1.2©© 
x 10 11 

7.0© 
x 20“ 8 


TRIPLEX CONFIGURATION 3 

TRIPLE 1 

1.20® 
x 10 -8 

1.2@® 
x 10“ 8 

1.2®® 
x 10“ 8 

1.20® 
x 10 -8 

1.20® 
x 10 -8 

120® 
x 10— 8 

120® 

x 10“® 

1.20® 
x 10~ 8 

1.2®® 

x 10 -8 

120® 
x 10 -8 

1.20® 
x 10 -8 

1.2®® 
x 10“ 8 

1.20® 
x 10 -8 

1.9©@® 

x 10 * 

TRIPLE 2 

2.8©@® 

x 10““ 

2.8©®® 
x 10~“ 

2900® 

.-—11 
x 10 

29©0® 
x 10 

2.7© 
x 10- 10 

5.2© 
x 10- 10 

2.7© 
x 10“ 10 

2.7© 
x 10 _1 ° 

2-8©@® 
x lO^** . 

2.7© 
x 10- 10 

2.8©®© 

x 10““ 

2.8©0® 
x 10 11 

3.20®® 

x 10- 11 

7.0© 
x 10 -9 

TRIPLE 3 

1.7® 
x 10~“ 

1.7© 
x 10““ 

1.7© 
x 10“ 11 

17© 
x 10-“ 

2.6© 
x 10 _1 ° 

5.1© 
x 10“ 10 

2.6© 
x 10 -10 

26© 
x 10— 10 

1.7© 
x 10 11 

2.6© 
x 10- 10 

1.7© 

: ii 

x 10 

1.7© 
x 10 11 

2.1© 
x 10 11 

7.0© 

x 10 -9 

TRIPLE 4 

1.7© 
x 10 _ “ 

17© 

xIO' 11 

1.7© 
,-—11 
x 10 

1.7© 
x 10““ 

2.6© 
x IQ- 10 

5.1© 
x 10 10 

2.6© 
x 1 0” 1 0 

2.6© 
XIO - 10 

1.7© 
x 10 _U 

2.6© 
x IQ - 10 

1.7© 

x 10““ 

17© 
x 10 11 

21© 

XIO" 11 

7.0© 
x IQ- 9 


PRIMARY CONTRIBUTORS TO FAILURE PROBABILITY 0 -SENSOR, (cp) —CPU, 0 - TOTAL COMPUTE R, 0 -ACTUATOR, 0 -HYDRAULICS 
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TABLE 6-10 

SENSOR/COMPUTER /ACTUATOR RELIABILITY SUMMARY - 
DUAL-REDUNDANT COMPUTERS 


COMPUTER/ 

ACTUATOR 

INTERFACE 

CONFIGURATIONS 

COMPUTER/SENSOR INTERFACE CONFIGURATIONS ] 

DUAL CONFIGURATION 2 


NO. 1 

M, <*, 0, 0 

NO. 12 

w NO. 13 

0, 0, A N ,ct 

NO. 14 

0,0.a n ,m 

NO. ^15 
0, 6, h, (i 

NO. 3 

oc, 6,6 

NO. 4 

M,0,0 

NO. 16 
• < 

0,0, h 

NO. 29 
0, 0,3 

n 

NO.^7 

0 

NO. 30 
A n ,M 

NO. 31 

v'« 

NO. 32 

■A , 0 c 

NO. 26 
a n 

DUAL 1 

x 10^ 8 

9-2©®© 

x 10~ 8 

9.2©@© 
x 10~ 8 

9-2©@© 
x 10 8 

9.3©®© 
x 10“ 8 

9-3©©© 

x10 _T 

93©®© 
x 10 -8 

9.3©©© 

x 10“ 8 

9.2©®© 
x 10 -8 

9.3©®© 
x 10 -8 

9.2©®© 
x 10~ 8 

9.2.©@© 
x 10 8 

9.2©@© 
x ib -8 

99©®© 
x 10 8 

DUAL 2 

s.i©@© 

x 10~ 8 

5.1©®© 
x 10~ 8 

5.1©®@ 

x 10 — 8 

5.1©©© 
x 10 8 

5.1©@© 

x 10 8 

5-1 ©@© 

x 10~ 8 

5 1©®© 

x 10~ S 

5.1©®© 

x 10~ 8 

5.1©®© 

x 10~ 8 

5.1©®© 
x 10~ 8 

5.1©®© 

x 10~ 8 

5.1©@© 
x 10 8 

5.1©®© 
x 10~ 8 

5-8©®© 
x.10 8 

DUAL 3 

3.9© 
x 10 8 

3.9© 
x 10~ 8 

3.9© 
x 10~ 8 

3.9© 
x 10~ 8 

3.9© 
x 10~ 8 

3.9© 
x 10“ 8 

3.9© 
x 10 -8 

3.9© 
x 10“ 8 

39© 
x 10“ 8 

3.9© 
x 10~ 8 

39© 

x 10 8 

3.9© 
x 10“ 8 

3.9© 
x 10~ 8 

4.6© 
x 10 -8 

DUAL 4 

3.9© 
x 10~ 8 

3.9© 
x 1 0“ 8 

3.9© 
■x 10 -8 

3.9© 
x 10 -8 

3.9© 
x 10~ 8 

3.9© 
x 10~ 8 

3.9© 
x TO -8 

39© 
x 10 -8 

39© 
x 10~ 8 

39© 
x 10~* 

39© 

x 10~ a 

3-9© 
x 10 -8 

3.9© 
x 10~ 8 

4.6© 
x 10 -8 

DUAL 5 

3.9© 
x 10~ 8 

3.9© 
x 10“ 8 

3.9© 
x 10~ 8 

3.9© 
x TO -8 

3.9© 
x 10 -8 

39© 
x 10 -8 

3.9© 
x 10^ 8 

3.9© 
x 10 -8 

3.9© 
x 10~ 8 

3.9© 
x 10 -8 

3.9© 
x 10~ 8 

3,9© 
x 10 -8 

3.9© 
x 10 _S 

4.6© 
x 10~ 8 


DUAL CONFIGURATION 3 

DUAL 1 

1.2© 

x 10 -7 

1.2© 
x 10~ 7 

1.2© 
x 10 -7 

12© 

x 10 -7 

1.2© 

x10~ 7 

12© 
x 10 -7 

1.2© 
x 10~ 7 

1.2© 
x 10~ 7 

12© 
x TO -7 

1.2© 
x 10~ 7 

1.2© 
x 10 _ 7 

13© 
x 10 _7 

1.2© 
x 10~ 7 

13© 
x 10~ 7 

DUAL 2 

7.5© 
x 10 -8 

7.5© 
x 10 _S 

7.5© 
x 10 -8 

7.5© 
x 10~ 8 

7.5© 

x 10 _S 

7.5© 
x 10 -8 

7.5© 
x 10 -8 

7.5© 
x 10 -8 

7.5© 
x 10 -8 

73© 
x 10 _ ' 8 

7.6© 
x 10~~ 8 

7:&© 
x 10 _S 

7.5© 
x 10 -8 

8.2© 
x 10~~ 8 

DUAL 3 

6.3© 
x 10 -8 

6.3© 
x 10~ 8 

6.3© 
x 10 -8 

63© 
x TO -8 

6.3© 
x 10~ 8 

6.3© 
x 10^ 8 

6.3© 
x to -8 

6.3© 

x'10 -8 

6.3© 
x 10 -8 

6.3© 
x 10~ 8 

6.3© 
■x 10~ 8 

63© 
x 10 8 

63© 
x 10“ 8 

6.9© 
x 10 -8 

DUAL 4 

6.3© 
x 10 -8 

6.3© 
x 10~ 8 

63© 
x 10 

6.3© 
x 10~ 8 

6.3© 
x 10 -8 

63© 
x 10 -8 

6.3© 
x 10"" 8 

6.3© 

x'10^ 8 

6.3© 
x 10~ 8 

6.3© 
X 10 -8 

6.3© 
x 10~ 8 

63© 
x 10~ 8 

6.3© 
x 10~ 8 

6.9© 

x 10~ 8 

DUAL 5 

6 3© 
x 10 -8 

63© 
x 10 ' 8 

63© 

x kT 8 i 

6.3© 

xTO -8 

6.3© 
x lO"" 8 

6.3© 

xIO -8 

6.3© 
x 10~ 8 

63© 
x 10~ 8 

E.3© 
x 10“ 8 

63© 
x 10 -8 

63© 
•x 10 -8 

6.3© 
x 10~ 8 

63© 
x 10~ 8 

69© 
x 10 — 8 


PRIMARY CONTRIBUTORS TO FAILURE PROBABILITY © — TOTAL COMPUTER, © — ACTUATOR, © — HYDRAULICS 
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TABLE 6-10 

SENSOR/COMPUTER/ACTUATOR RE LIABILITY SUMMARY- 
DUAL-DUAL COMPUTERS 


COMPUTER/SENSOR INTERFACE CONFIGURATIONS 


COMPUTER/ 

ACTUATOR 

INTERFACE 

CONFIGURATIONS 

DUAL-DUAL CONFIGURATION 2 

NO. 1 

fi, a, $, 6 

, NO. 12 

M 'Vh 

, NO. 13 

6,6, A .„a 

, NO. 14 

0.0. a n ,m 

NO. 15 
5, 0. h, n 

NQ. 3 

ot.e.e 

NO. 4 

u, d.e 

(JO. 16 

6.0, h 

JMO. 29 
6, 6, a n 

NO. 27 

v.o 

NO. 30 

A N' M 

NO. 31 

v h ' 

NO. 32 

V* 

NO. 26 
a n 

DUAL-DUAL 1 

1.6©@ 
x 10 -8 

1.6®© 

x 10” 8 

1.6@© 
x 10~ 8 

1.6@© 
x 10~ 8 

1.6®© 
x 10~ 8 

1.7®@ 
x 10 8 

1.6®© 
x 10 -8 

1.6®© 
x 10 -8 

16®© 

x 10 _8 

1.6@© 
x 10 -8 

1.6®© 
x 10 ^ 

16®© 

x 10~ 8 

16®© 
x 10 _S 

2.3©©®© 
x 10 _S 

DUAL-DUAL 2 

1.4®© 
x 10 _8 

1.4®© 

x 10“ 8 

14®© 

x 10“ 8 

1.4®© 

x 10“ 8 

1.4®© 

x 10~ 8 

1.5@© 
x 10~ 8 

14®© 

x 10 -8 

1.4®© 
x 10 8 

1.4@© 

x 10~ 8 

14@© 
x 10~ 8 

1.4®© 
x 10“ 8 

14®© 

x 10 -8 

14®© 

x 10~ 8 

2.1©©®© 
x 10“ 8 

DUAL-DUAL 3 

3.9@ 
— o 

x 10 

3.9© 
x 10“ 9 

3.9@ 
x 1 (T 9 

3.9© 

xIO -9 

4.2© 

xIO -9 

4.4© 
x 10 -9 

4.2© 
x 10“ 9 

4.2© 

xIO -9 

3.9© 
x 10“ 9 

4.2<SC) 

xIO- 9 

3.9© 
x 10 -9 

3.9© 
x 10 -9 

3.9© 
x lO ^ 9 

11©© 
x 10~ 8 

DUAL-DUAL 4 

3.9© 
x 10“ 9 

3.9© 

x.1.0” 9 

3.9© 
x 1(T 9 

3.9© 
x 10 -9 

4.2© 
x 10 -9 

4.4@ 

xIO" 9 

4.2© 
x 10 -9 

4.2© 

xIO -9 

3.9© 

xIO -9 

4.2© 
x 10 - 9 

39© 
x 10 -9 

3.9© 
x 10 - 9 

3.9© 

xIO" 9 

1.1©© 
x 10~ 8 

DUAL-DUAL 5 

3.9@ 

x10~ 9 

3.9© 
x 10 -9 

3.9© 
x 10“ 9 

3.9<SC) 
x 10 y 

4.2© 
x 10 -9 

4.4© 
x 10“ 9 

4.2© 
x 10 9 

4.2© 
x 10 -9 

3.9© 

xIO -9 

4.2© 
x 10 -9 

3.9© 
x 10 -9 

3.9© 
x 10 -9 

39© 
x 10" 9 

1.1©© 
x 10 _8 


DUAL-DUAL CONFIGURATION 3 

DUAL-DUAL 1 

1.6©@© 

x 10 _7 

1-6©@© 

x 10~ 7 

1.6©®© 

x 10 -7 


1.6©®© 

x 10 -7 

17©®© 
x 10~ 7 

1.6©®© 

x 10~ 7 

16©®© 
x 10~ 7 

16©®© 

x 10 -7 



1-6©®© 

x 10 -7 

1.6©®© 

x 10 _7 

17©®© 

x 10“ 7 

DUAL-DUAL 2 

1.1© 
x ICf 7 

11© 
x 10“ 7 

1.1© 
x 10 -7 

i.i© 

x 10~ 7 

11© 
x 10~ 7 

11© 

x 10“ 7 

11© 

X 10~ 7 

1.1© 
x 10 -7 

11© 

x 10 -7 

11© 
x 10" 7 

1.1© 
x 10~ 7 

11© 
x 10“ 7 

11© 

x 10“ 7 

1.1© 
x 10 -7 

DUAL-DUAL 3 

9.8© 
x 10“ 8 

9.8© 
x 10“ 8 

9.8© 
x 10~ 8 



9.8© 
x 10 -8 

9.8© 
x 10 _8 

9.8© 
x 10“ 8 

9.8© 
x 10~ 8 


9.8© 
x 10 -8 



10© 
x 10~ 7 

DUAL-DUAL 4 

9.8© 
x 10 -8 

9.8© 
x 10 -8 

9.8© 
x 10~ 8 

9.8© 
x 10 -8 

9.8© 
x 10 8 

9.8© 
x 10 -8 

9.8© 
x 10~ 8 

9.8© 
x 10~ 8 

9.8© 
x 10“ 8 

9.8© 
x 10~ 8 



9.8© 
x 10““ 8 

1.0© 
x 10 -7 

DUAL-DUAL 5 

9.8© 
x 10“ 8 

9.8© 
x 10~ 8 

9.8© 

x10“ 8 

9.8© 
x 10 -8 

9.8© 

x 10 -8 

9.8© 

xIO -8 

9.8© 

x 10 -8 

9.8© 
x 10~ 8 

9.8© 
x 10~ 8 

9.8© 
x 10~ 8 

9.8© 
x 10 -8 


9.8© 
x 10 -8 

1.0© 
x 10 -7 


PRIMARY CONTRIBUTORS TO FAILURE PROBABILITY (D — SENSOR. ( 0 ) — SENSOR COMPUTER DATA PROCESSOR, @ - TOTAL COMPUTER, ® — ACTUATOR, © — HYDRAULICS 
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FIGURE 6-47. SYSTEM RELIABILITY ASSESSMENT (RELIABILITY GOAL: 

7 x 10“® FAILURE PROBABILITY) 


toward the right with increased probability of system failure. Dual No. 1 
would then be the first eliminated on the basis of not satisfying the 
reliability goal. 

The lower MTBF of the DUAL-DUAL (dual CPU, dual computer) configurations 
tends to discourage its use. Assummihg a 3200-hour dual CPU computer MTBF, 
the availability of two such computers with comparison monitoring is slightly 
higher than three 4000-hour MTBF in-line monitored computers. However, 
three computers provide a potential spare for possible in-service dispatch- 
ability requirements. With one computer inoperative, the system would revert 
to a dual configuration. 


The RSSAS sensor array has more than the necessary redundancy and most of 
the components are required for dispatch as part of other systems so their 
availability is not chargeable to RSSAS alone. Two sources of e (and ej are 
required for dispatch by the attitude display system. Two sources of air data 
are also currently required and provide the u signal for RSSAS. The angle-of- 
attack transducers are required for dispatch by the stall warning system. 
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An aircraft is seldom dispatched without a fully operative actuation 
system (all hydraulics are mandatory). Thus, the minimum number of actuators 
required for safety is also adequate for RSSAS. For symmetry of control, how- 
ever, it is important that a single computer control an elevator surface on 
each side of the vertical tail. Thus, a dual-actuator arrangement with dual 
inputs to each actuator is desired. 

Based upon the considerations discussed above, the selected systems are 
those shown in Figure 6-48. These are Triple 1.2 with a reversion capability 
to Dual 2.2. 


6.2.6 Thrust/Pitch Compensation Sensor Interface . — The need for auto- 
matic compensation of the pitching effects resulting from thrust changes is 
peculiar to aircraft with wing-mounted engines and not a requirement of the 
relaxed static stability concept. Pitch/thrust compensation will, however, be 
provided on the EET with nearly the same reliability of the static stability 
augmentation, since these two functions share computation and actuation devices. 
The only differences exist in the sensor interface. The pitch/thrust compensa- 
tion interface with the engines is shown in Figure 6-49. 
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RIGHT 

ENGINE 




LEFT 

ENGINE 


FIGURE 6-49. PITCH/THRUST COMPE^SATIQN SENSOR INTERFACE 

Loss of the thrust data froiji either engine results in the compensator 
providing only half the required fjirust/pitch gain. Although degraded, signi- 
ficant compensation is still provided. Loss of both engine thrust data elimi- 
nates the thrust/pitch compensation. The probability of these two events arp: 

Loss of single engine thrust data 

Q = 2 ( a E j + A EQ^ 

Q = 2(100x1 0" 6 t 5 DQx10" 6 )(1) 

Q = 1.2*!0" 3 

where 

ET = Engi'pe transducer 
ED = Engine data system 
t = One hour 
x = Failures per hour 

Loss of both engine thrust data 

Q = (^ ET + x ED ) 2 (t ) 2 

Q = (lOOxlO -6 + 500 x 10"-) 2 (1) 2 
Q = 3.6xlQ" 7 
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FIGURE 6-50. RSSAS AUTOTRIM INTERFACE 

Failure rates are based on current DC-10 operational data. 

6.2.7 RSSAS Auto Trim Interface. — The RSSAS autotrim function has been ■: 
previously described in Paragraph 6.1.4. The interface of the discrete FAC 
trim outputs and the horizontal stabilizer trim system is relatively simple. 

As shown in Figure 6-50, each of the FACs, regardless of redundancy level, 
provides its discrete trim outputs, up-trim or down-trim, on separate signal 
paths. Then all of the up-trim wires are connected together and all of the 
down-trim wires are connected together. These separate trim commands are 
provided to the stabilizer trim control valve, which in turn commands the 
trim motor to drive the horizontal stabilizer at a fixed rate. 

Although a simple mechanization, it is expected that the probability of 
loss of the autotrim will exceed that of the basic RSSAS function. Autotrim 
loss probability is calculated as: 

Q = (^CONTROL ^TRIM ^ = (28x10 + 38x10 )(1) 

VALVE MOTOR 

Q = 6.6xl0" 5 

When this occurs, the manual RSSAS trim director is activated and the RSSAS 
series elevator displacements are off-loaded using the primary trim system as 
described in Paragraph 6.1.4. Again, the failure rates used in this calculation 
are based on DC-10 operational data. 
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SECTION 7 

IMPACT OF RSSAS ON THE AIRCRAFT DESIGN AND CERTIFICATION 

The incorporation of any or all systems on a commercial aircraft requires 
significant design, development, analysis, verification, and demonstration 
efforts. A1 though most systems most comply with specific regulatory require- 
ments, satisfaction of these regulations is achieved through the normal design 
practices used by the airframe manufacturers and system/component suppliers to 
assure themselves of the quality and safety of their product. This section of 
the report provides an estimate of the effort in manpower aptl dollars required 
to incorporate relaxed static stability in an EET aircraft, with consideration 
of the FAA regulations for the aircraft certification which relate to this 
system. 


7.1 Regulatory Requirements 


An aircraft with relaxed static stability must comply With certain FAA 
requirements which specify performance for both the aircraft and augmentation 
system. The specific regulations which relate to the unique stability charac- 
teristics of the aircraft have been analyzed and are referenced and briefly 
discussed as follows: 


Part 25 Airworthiness Standards? Transport Category Airplanes 

25.21(c) The controllability, stability, trim, and stalling characteristics 
must be demonstrated for the unaugmented aircraft and every expected 
augmented aircraft configuration. 

25.23(a) Ranges of acceptable centers of gravity may vary depending upon the 
configuration of the augmentation system. In practice, this depend- 
ency would have to be established with regard to the augmentation 
configuration at dispatch. 

25.103 Most unfavorable center of gravity for stall may vary as a function 
of augmentation configuration. 


25.105 

25.107 

25.111 

25.115 


Takeoff performance may be a function of augmentation configuration. 
Ground-to-air cycle must be demonstrated. 
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25.143 Controllability and maneuverability must be considered for unaug- 
mented and all augmented aircraft configurations. 

25.161 The unaugmented aircraft may not be able to maintain a trim condition 
in a turbulent atmosphere. 


25.171 

25.173 

25.175 


The unaugmented aircraft would not be able to satisfy the stability 
requirements of these paragraphs. The unaugmented aircraft must, 
however, be considered the failed condition and an associated accept 
able probability of occurrence established and demonstrated by 
analysis . 


25.201 

25.203 

25.205 


Stall characteristics may differ with augmentation configurations. 
Demonstration of all expected configurations is required. 


25.671 Unaugmented and augmented aircraft configurations must be able to 
withstand primary flight control system failures and demonstrate 
satisfactory controllability. Failures critical to unaugmented and 
augmented aircraft may not be the same. 

25.672 Failures of the augmentation system must be demonstrated to provide 
acceptable flying qualities, or shown to be sufficiently improbable. 


25.1309 Critical failure conditions must be verified to be sufficiently 
improbable. 


25.1503 A speed limitation may be established if satisfactory performance 
25.1505 canno t be achieved at high speeds. 

7.2 System Validation 

The validation of an avionics system is an integral part of the normal 
design process required to verify each element of the design, and it provides 
the data necessary to progress to the next step in the program. Figure 7-1 
is a summary of a 42-month program for the validation of an RSSAS system on a 
new aircraft design. The subtasks of this program are classified as perform- 
ance compliance, fault-related, or system description and design control. As 
noted in Figure 7-1, several data submittals to the FAA are anticipated and 
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FIGURE 7-1. RSSAS VALIDATION SCHEDULE 



although the form of the FAA reports may be unique, in most cases the require- 
ment to collect these data is simply consistent with the design process. 
Exceptions exist only in the area of qualitative evaluations of the aircraft 
or RSSAS, which usually require additional testing to the motion base simulator 
and flight test program. 

The performance compliance process begins with the aircraft simulation 
used to develop and analyze the RSSAS. This total simulation is then used to 
conduct motion base testing to evaluate the aircraft/ system flying qualities. 
Iron bird* testing is used to validate the system hardware which is then demon- 
strated on the flight test vehicle. It should be noted that all performance 
verification includes both fault-free operation and failure configurations 
based upon the FMEA and fault analyses. 

The fault analyses include determining the effects of system failures 
and formulation of the monitoring concepts. This usually includes detailed 
hardware FMEAs and system fault and fault tree analyses. These analyses con- 
tribute to aircraft and RSSAS maintenance plans and certification documentation. 

System description and design control are essentials of the design, 
analysis, and verification tasks to assure a proper continuing understanding 
for both the designer and monitor (including the FAA) of the intended function 
of all elements of the hardware and system. .The design control feature must 
be defined and maintained throughout the life of the aircraft/system. 

7.3 RSSAS Implementation Cost 

For the purpose of this study, the cost of incorporating the relaxed 
static stability concept in the EET is determined as the differential of 
the identical aircraft with and without RSSAS. This is somewhat different from 
the accumulated RSSAS implementation costs, since many of the required tasks 
are common to a conventional aircraft design. The primary contributors to the 
RSSAS cost are the airframe manufacturer and the suppliers of the primary 
components, the augmentation computers, and the new elevator actuators. 

*A full-scale aircraft development fixture consisting of (1) the mechanical 
primary control and hydraulic supply systems duplicating the aircraft hard- 
ware and routing, (2) a cockpit simulation with pilot controls and displays, 

(3) test stations for installation and control of avionics systems, and 

(4) a computer simulation of the aircraft dynamics. 
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The following engineering disciplines and corresponding primary additional 
areas of effort would be required: 

Aerodynamics 

i Flying qualities criteria formulation and evaluation 

• Stability ahd control analysis 

(Aerodynamic definitions, wind tunnel testing, etc., require 
the equivalent level of effort) 

Avionics 

• RSSAS hardware and system specification, system performance 
analysis, hardware verification, and vendor coordination 

Electrical 

• RSSAS electrical component and wiring installation 
Flight Test 

• Maintenance of the test aircraft and the conduct of RSSAS flight 
testing and certification demonstrations. 

Laboratory 

• Management of laboratory facilities and support engineering tests 
Mechanical 

• Elevator actuator specification, hardware verification, vendor 
coordination, and installation design 

Reliability and Safety 

• System reliability and safety analysis 

• Monitoring of vendor reliability analyses 
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Structures 


• Structure analysis with system operation (although wing and 

empennage position and sizing, landing gear, and door location 
may be different from conventional aircraft, the engineering 
tasks are assumed equivalent) 

Other Departments 

• Engineering System Compliance, Environmental, Human Factors, 

Operational Engineering and Flight Performance, Weights 

— Involved with assuring RSSAS/aircraft design but of 
significantly lower manpower level 

• Product Support 

- Involved with maintaining the system in service 

• Material 

- Performs purchasing, scheduling, and on-site inspection 

The estimated manpower and flight test requirements for the most intensive 
Douglas design engineering effort are: 


DEPARTMENT 

MAN-HOURS 

Aerodynamics 

10,000 

Avionics 

92,000 

Electrical 

3,000 

Flight Test 

275,000 

Laboratory 

10,000 

Mechanical 

17,000 

Reliability and Safety 

18,000 

Structures 

2,000 


Totals: 437,000 

plus 275 aircraft flight hours 
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An additional factor of 25 percent of the design engineering (all of the 
.above engineering except flight test and laboratory) must be included to cover 
drawing check, coordination, and other paper-processing requirements, bringing 
the total number . of man-hours required to 475*000. 

Assuming a 'representative a i roraf t i ndus try cost of $40 per engineering 
man-hour and $'10^000 per aircraft flight hour, the total nonrecurring airframe 
manufacturer's cost in 1 979 dollars is $21 .75 million. 

The supplier costs are estimated from equivalent programs previously com- 
pleted or currently in progress and assumes at least a 200-aircraft base over 
Which to spread the /nonrecurring charges. 

Elevator Actuators $60,000 per shlpset 

RSSAS Computers $120,000 per shipset 

Using the 200-aircraft base to establish the total result gives: 

Ai rf rame costs 
Suppl ier costs 

Total 



$288,750* per aircraft 


*in 1979 dollars 


238 



REFERENCES 


1. Cooper, G.E. and Harper, R.P., "The Use of Pilot Rating in the Evaluation 
of Aircraft Handling Qualities," NASA TN D-5153, April 1969. 

2. Anonymous, "Military Specification, Flying Qualities of Piloted Air- 
planes," MIL-F-8785B(ASG) , 7 August, 1969. 

3. Neal, T.P. and Smith, R.E., "An In-flight Investigation to Develop 
Control System Design Criteria for Fighter Airplanes," AFFDL-TR-70-74, 
Volume 1, December 1970. 

4. Rickard, W.W., "Longitudinal Flying Qualities in the Landing Approach," 
Douglas Paper 6469, May 1976. 

5. Wasserman, R. and Mitchell, J.F., "Inflight Simulation of Minimum 
Longitudinal Stability for Large Delta-Wing Transports in Landing 
Approach and Touchdown," AFFDL-TR-72-143, Volume 1, February 1973. 

6. Barr, N.M., Gangsaas, D.,and Schaffer, D.R., "Wind Models for Flight 
Simulator Certification of Landing and Approach Guidance and Control 
Systems," FAA-RD-74-206, December 1974. 

7. Anonymous, "Proposals for Revising MIL-F-8785B, 'Flying Qualities of 
Piloted Aircraft,' Volume 1, Proposed Revisions," AFFDL-FGC Working 
Paper, August, 1977; Corrected February, 1978. 

8. Markland, C.A., "Optimal Model -Fol lowing Control System Synthesis 
Techniques," Proceedings I.E.E., Volume 117, No. 3, March 1970 


239 




APPENDIX 1 
BANDWIDTH MODEL 


The Bandwidth Model is a pi lot-in- the-loop analytical method which 
permits the estimation of the flying qualities rating a human pilot would 
give the pitch maneuvering characteristics of an arbitrary aircraft config- 
uration. The airplane need not be built or flown; only a mathematical model 
of the pitch response (i.e., pitch transfer function) is needed. The rating 
is based on the closed-loop performance of a pilot model plus airplane system 
in a pitch-tracking task. 

The method involves calculation of the optimal pilot model compensation 
for closed-loop pitch attitude tracking, as determined by using the adjust- 
ment rules of the Bandwidth Model. The method was originated by R. E. Smith 
and T. P. Neal of Cornell Aeronautical Laboratories in AFFDL-TR-70-74 
(Reference 3). 

The primary required information is the airplane-plus-control -system 
transfer function 0/F s or e/6 0 . Other inputs include desired bandwidth and 
droop, maximum allowable resonance, pilot transport delay, and maximum allow- 
able pilot-lag-compensation angle. Primary outputs of the method are the 
computed pilot model parameters. Other outputs are the pilot model phase 
angle at the bandwidth frequency, the maximum closed-loop amplitude (resonant 
peak), and the low-frequency asymptotes of the transfer function. The method 
also yields the amplitude and phase angle versus frequency of the following 
transfer functions: 


1. Open loop (e/F s ) 

2. Open loop plus delay (e/e* = e - ^ 5 e/F s ) 


3. Open loop compensated (e/e r = 

w 


4. Closed loop compensated (e/e 


K e - tS (Tpl S e/F s ) 

( v s+1) 

e/e. 


1 + e/e. 


A chart is included in this report which permits the estimation of flying 
qualities ratings by use of the ouputs of the program. 
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APPENDIX 2 

MOTION-BASE SIMULATOR FACILITY 
Six-Axis Motion Base 

Douglas has designed and fabricated a six-axis motion-simulation system 
capable of supporting, a complete cockpit simulator and providing realistic 
motion' cues (Figure A-l). The cockpit simulator is attached to a base sup- 
ported : by six hydraulic jacks arranged in the configuration developed by the 
Franklin Institute. The most important specifications are summarized below. 


AXIS 

EXCURSION 

VELOCITY 

ACCELERATION 

Heave 

1.07 m 

0.99 m/s 

1.65 g 

Sway 

1.71 m 

1.70 m/s 

2,43 g 

Surge 

1.65 m 

1.80 m/s 

1.50 g 
7.8 Rad/s 2 
7.8 Rad/s 2 

A 

Roll 

0.54 Rad 

0.62 Rad/s 

Pitch 

0.58 Rad 

0.59 Rad/s 

Yaw 

0.68 Rad 

0.63 Rad/s 

7.9 Rad/s 


These figures are for a payload of 44,000 kg. The figures for pitch and 
yaw refer to the platform axis. With the separation between aircraft center 
of gravity and the pilot's positon, the pitch and yaw motions appear primarily 
as heave and sway. 

The motion system is controlled by a minicomputer which implements the 
geometric transformations, washout algorithms, and fail-safe features. The 
minicomputer is tied to the Sigma 5 computer via a digital data link. The 
minicomputer exercises servo valves and receives feedback data, via analog/ 
digital converters, from Douglas -developed Linear Velocity Differential Trans- 
formers (LDVT). These transformers provide linear readout over the full travel 
of the hydraulic jacks. The motion system is currently equipped with a large- 
scale transport cockpit, and visual simulation is available from the Redifon 
visual flight attachment (Figure A-2). 

Cockpit Interface Hybrid Satellite 

Cockpit simulators are, as a matter of necessity, located some distance 
from the main Sigma 5 computer facility. The Interface Hybrid Satellites are 
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I RAD-96020-64 


FIGURE A-2. LARGE-SCALE TRANSPORT COCKPIT 


FIGURE A-1. SIX-AXIS MOTION-BASE SIMULATOR 


I RAD-96020-63 
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portable systems that may be located adjacent to a cockpit simulator and are 
designed to provide all of the necessary interfacing functions to the main 
computer system. The satellites contain up to 64 (A to D) and (D to A) 
channels, a small analog computer, and a PDP 11/40 digital computer. The 
systems are tied to the Sigma 5 through a digital link, ensuring noise-free 
communication. Patch boards are utilized to provide the necessary flexibility. 
In addition to providing the communication and conversion functions between 
the cockpit and the Sigma 5, the satellites possess substantial hybrid comput- 
ing power that serves to unburden the Sigma 5 and reinforce its ability to 
accommodate real-time parallel tasks. 

There is an advanced analog capability consisting of two Milgo 4100 com- 
puters. These very large solid-state systems contain in excess of 550 operas • 
tional amplifiers each. They possess fully automatic programming features 
and are used extensively in supporting full cockpit simulators. These may 
include significant elements of the avionics systems. 

Hybrid System 

The largest and most sophisticated system in the laboratory is the XDS 
Sigma 5, Astrodata Ci-5000 hybrid. Their separate analog and digital capa- 
bilities are rendered compatible through a 32- by 32-channel system of Analog 
to Digital (A to D), and Digital to Analog (D to A) converters. These also 
provide the means of interfacing the digital computer with the parallel char- 
acter of the real world as exemplified by pilots, cockpits, instruments, etc. 
The hybrid computer system represents the successful marriage of digital and 
analog techniques, and goes far in eliminating the inadequacies of either of 
the systems applied separately. Since its installation, this equipment has 
provided a full simulation of Douglas' commercial transport, the DC-10, and 
the Military STOL aircraft, the YC-15. 

Hybrid System Software 

Simulation programs are written in problem- or user-oriented languages 
such as FORTRAN, CSSL, and SL-1. Although not stated explicitly, every pro- 
grammer writing in such languages assumes that the computer will properly under 
stand the language in which he wrote his program and will faithfully follow 


244 



his instructions. However, the computer hardware alone cannot do this. There 
is resident in the computer a program or a set of programs that will inter- 
pret the programmer's instruction' language, convert the programmer's instruc- 
tions to machine directives, and cause the computer hardware to perform the 
desired acts. 


Visual Flight Attachment (VFA) 

One of the pilot's primary sources of data is the scene viewed from the 
forward window of the aircraft. This is particularly true during final ap- 
proach where runway perspective, lighting, and landing aids provide signifi- 
cant data which can be critical to system performance. 

Flight simulation aims at validating the design of a system, including 
the pilot, through study of the actual performance. If the pilot is to func- 
tion in a normal and realistic fashion, he must be provided with data, includ- 
ing a visual scene, in as realistic a manner as possible. This is the purpose 
of the visual flight simulator at the Long Beach facility. 

The visual simulator consists of two models, a servodriven television 
camera and the associated control electronics and lighting. The larger model, 
which consists of the airport, runway, and surrounding terrain, is three- 
dimensional (13 meters long by 4.6 meters high), with a scale of 750 to 1. 

A 3048-meter runway is located at the longitudinal center of the model. The 
runway is complete with approach lights, strobes, marker and threshold bars, 
touchdown zone, VASI, taxiway, edge, and centerline lights. The model is 
illuminated by a bank of fluorescent lights which can be controlled to pro- 
vide daylight, dusk, or night conditions. The second model is 1.2 by 1.2 
meters with a scale of approximately 1.6 kilometers to the inch. This model 
represents terrain and cloud cover as viewed from high altitude (Figure A-3). 

A Phillips Plumbicon television camera is mounted on a gantry. The 
gantry travels on tracks parallel to the model to provide longitudinal motion. 
The camera carriage itself is driven in two directions to provide lateral 
motion and changes in altitude. Servodriven mirrors and prisms in the optics 
of the camera provide roll, pitch, and yaw. 
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Primary control signals from a cockpit simulator serve as inputs to a 
computer-mechanized math model of the airplane dynamics. This computer is 
linked to a control computer which converts aircraft center-of-gravity coor- 
dinates to pilot's eye coordinates and controls camera motion. The cameras 
then "flies" the approach as directed from the cockpit. The system can be 
used in simulation of any aircraft for which a computer model is available. 

The video signal is sent to a television monitor which is viewed by the 
pilot through a collimating lens mounted approximately in the plane of the 
windscreen. MDC has undertaken a substantial amount of development in the 
area of these collimating lenses, and has produced the most advanced and dis- 
tortion-free optical system available anywhere for simulator applications. 
Specifications of the V FA system are given in the following paragraph. 



Maximum approach distance is 3.6 km. The eye altitude range of the air- 
port model is from 221 m (maximum) to 4.6 m (minimum). Maximum longitudinal 
lateral velocities are 225 knots and maximum sink rate is 10.2 m/s. The maxi 
mum pitch is 0.43 rad; heading and roll are unlimited. Maximum angular veloc 
ities are 0.75 rad/s (heading), 0.5 rad/s (roll) and 1.5 rad/s (pitch). 
Maximum angular accelerations are 0.5 rad/s squared (heading), 1.0 rad/s 
squared (roll) and 3.5 rad/s squared (pitch). Angular field of view is 0.24 
rad horizontal (±0.42 rad) and 0.63 rad vertical (+0.28 rad; -0.35 rad). 


FIGURE A-3. VISUAL SIMULATOR 


I RAD-96020-65 
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APPENDIX 3 


COMPONENTS EVALUATED IN 
THE RELIABILITY ANALYSES 
AND CRITERIA BASELINE 
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COMPONENTS EVALUATED 


ATA NO. 

NAME 

22-02-01 

Sensing Unit, Wheel Spin-up 

22-11-01 

Computer, Fit Gdnc Pitch 

22-11-02 

Panel, Cont, Pitch Gdnc 

22-11-03 

LVDT, Average Elevator 

22-12-01 

Computer, Fit Gdnc Roll 

22-12-02 

Panel, Cont, Directional Gdnc 

22-12-03 

LVDT, Average Aileron 

22-12-08 

Sensor, Control Wheel 

22-13-01 

Computer, Fit Gdnc Yaw 

22-13-02 

Gyro, Rate, Yaw 

22-13-03 

Switch, Test, Yaw Damper 

22-13-04 

Detector, AC Current 

22-15-20 

Panel Assy, Fit Gdnc Cont 

22-15-21 

Rack, Fit Gdnc Cont Pnl 

22-17-01 

Unit, Mode Ann Logic 

22-17-02 

Annunciator, Mode, Flight 

22-18-01 

Annunciator, Warning, A/P 

22-19-01 

Accelerometer Unit, Linear 

22-22-01 

LVDT, Auto Pitch Trim 

22-22-02 

Computer, Auto Pitch Trim 

22-31-02 

Switch Assy, Throt Disc, Left 

22-31-03 

Switch Assy, Throt Disc, Rt 

22-31-04 

Panel, Cont, Auto Throttle 

22-31-05 

Switch, Limit, Min Authority 

22-31-07 

Computer, A/T Speed Cont 

22-31-08 

Servo, Duplex Throttle 

22-31-09 

Gearbox, Auto Throttle 

22-31-10 

Annunciator, Warning, ATS 

22-31-11 

Annunciator, Wrn, ATS (F.0. ) 

22-31-12 

Switch, Test, Speed Control 

22-33-01 

Switch, Test, Stall Warning 

22-33-02 

Sensor, Angle of Attack 

27-11-01 

Regulator, Aileron 

27-12-01 

Actuator Assy, Aileron Trim 
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ATA NO. NAME 


27-12-02 

Trim Assy, Aileron Ctr Wing 

27-12-03 

Control Assy, Trim 

27-13-02 

Valve, Check, -8 

27-13-03 

Valve, Check, -10 

27-13-05 

Restrictor, 2-Way Vise 

27-13-20 

Actuator Assy, Inbd Ail 

27-13-21 

Valve, Flow Cont, Elec-Hyd 

27-13-23 

Valve, SO, Sol Oper 

27-13-24 

LVDT, A/P Actuator 

27-13-25 

Filter, A/P Actuator 

27-13-26 

Valve, Main Control 

27-13-30 

Actuator Assy, Outbd Ail 

27-13-31 

Valve, Flow Cont, Elec-Hyd 

27-13-33 

Valve, SO, Sol Oper 

27-13-34 

LVDT, A/P Actuator 

27-13-35 

Filter, A/P Actuator 

27-14-03 

Indicator, Surface Pos 

27-21-01 

Regulator, Rudder 

27-22-02 

Actuator, Rudder Trim 

27-23-02 

Valve, Check, -6 

27-23-20 

Actuator Assy, Lower Rudder 

27-23-21 

Valve, Flow Cont, Elec-Hyd 

27-23-23 

Valve, SO, Sol Oper 

27-23-24 

LVDT, A/P Actuator 

27-23-25 

Filter, A/P Actuator 

27-23-26 

Valve, Main Control 

27-23-30 

Actuator Assy, Upper Rudder 

27-23-31 

2-Valve, Flow Cont, Elec-Hyd 

27-23-33 

3-Valve, SO, Sol Oper 

27-23-34 

3-LVDT, A/P Actuator 

27-23-35 

1 -Filter, A/P Actuator 

27-23-36 

1 -Valve, Main Control 

27-26-01 

Valve, Check 

27-26-02 

Valve, Check 

27-26-04 

Valve, Check 
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ATA NO. NAME 


27-26-05 

Valve, Check 

27-26-06 

Valve, Shut-off, Motor Oper 

27-26-07 

Switch, Low Level, Comp 

27-26-20 

Pump, Motor, Alt Non Rev 

27-26-21 

Valve S/0, Pressure Oper 

27-26-30 

Sump, Alt Rud & HS 

27-26-31 

Sump, Alt Rud 

27-26-31 

Compensator, Motor Pump 

27-31-03 

Regulator, Elevator 

27-31-04 

Regulator, Elevator 

27-32-01 

Actuator, Duplex, ELF/FL 

27-32-02 

Programmer, ELF/FL 

27-32-03 

Indicator, Load Feel, Elev 

27-32-05 

Transmitter, Load Feel, Elev 

27-32-06 

Switch, Elev Feel 

27-32-07 

Switch, Manual Slew 

27-33-02 

Valve, Check, -12 

27-33-03 

Valve, Check, -10 

27-33-04 

Restrictor, 2-Way Vise, Elev 

27-33-20 

Actuator Assy, Inbd Elev 

27-33-21 

Valve, Flow Cont, Elec-Hyd 

27-33-23 

Valve, SO, Sol Oper 

27-33-24 

LVDT, A/P Actuator 

27-33-25 

Filter, A/P Actuator 

27-33-26 

Valve, Main Control 

27-33-30 

Actuator Assy, Outbd Elev 

27-33-31 

Valve, Flow Cont, Elec-Hyd 

27-33-33 

Valve, SO, Sol Oper 

27-33-34 

LVDT, A/P Actuator 

27-33-35 

Filter, A/P Actuator 

27-33-36 

Valve, Main Control 

27-35-01 

Shaker, Stick 

27-41-07 

Switch, Wheel, Horiz Stab 

27-41-08 

Switch, Alt Trim, Horiz Stab 

27-43-02 

Valve, Check, -8 

27-43-04 

Brake, Trim, Horiz Stab 
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ATA NO. 


NAME 


27-43-05 

Valve, Check 

27-43-06 

Restrictor, 2-Way 

27-43-07 

Damper, Surge 

27-43-30 

Motor, Trim, Horiz Stab 

27-43-31 

Valve, So, Sol Oper 

27-43-40 

Valve, Control, Primary Trim 

27-43-41 

Valve, So, Sol Oper 

27-43-42 

Valve, Flow Cont, Horiz Stab 

27-43-43 

Valve, Check, -6 

27-44-01 

Gearbox, Horiz Stab Drive 

27-44-04 

Actuator Assy, Horiz Stab 

27-44-08 

Coupling, Torsional 

27-45-01 

Sensor, Horiz Stab Drum 

27-45-02 

Sensor, Horiz Stab Elec 

27-52-01 

Cylinder, Act, Inbd Wing Flap 

27-52-02 

Cylinder, Act, Outbd Wg Flap 

27-52-03 

Valve, Control, Wing Flap 

27-52-05 

Valve, Check, Press 

27-52-07 

Restrictor, 2-Way, Out Flap 

27-52-08 

Restrictor, 2-Way, O.R. Flap 

27-52-09 

Restrictor, 2-Way, Inbd Flap 

27-52-10 

Restrictor, 2-Way, I.R. Flap 

27-52-11 

Valve, Falp Lock 

27-52-12 

Restrictor, 2-Way 

27-52-13 

Manifold, Flap Up 

27-52-14 

Valve, Check 

27-54-01 

Indicator, Pos, Flap/Slat 

27-54-02 

Transmitter, Pos, Outbd Flap 

27-54-03 

Transmitter, Flap Handle 

27-54-04 

Transmitter, Pos, Inbd Flap 

27-54-05 

Switch, Arming, LDG Flap 

27-54-07 

Switch, Flap Intlk, G/A 

27-56-01 

Actuator, Duplex, ELF/FL 

27-56-02 

Programmer, ELF/FL 

27-56-03 

Switch, Limiter Cvrd, Flap 
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ATA NO. 

NAME 

27-61-20 

Actuator Assy, Spoil Dr Svo 

27-61-21 

• Valve, Spoil Dr Svo 

27-62-01 

Eight, Speed Brake 

27-63-01 

Actuator, Elec, Spoiler Cont 

27-63-02 

Control Unit, Grd Spoiler 

27-65-01 

Actuator Assy, Spoiler Cont 

27-65-02 

Restrictpr, 2 -Way Vise 

27-66-02 

Transmitter, Pos, Spoiler 

27-68-01 

Sensor, Prox Spoiler A 

27-68-02 

Sepsor, Prox Spoiler B 

27-71-Q1 

Damper, Buzz, Outbd Ail 

27-71-02 

Restrictpr* Returp, Filtered 

27-73-Q1 

pamper. Buzz, Elevator 

27-73-02 

Damper, Elevator 

27-73-03 

Restrictor, Return, Filtered 

27-82-01 

Cylinder, si at 

27-82-Q3 

Valve, cpntroi, si at 

27-82-03 

Valve, Control, Slat 

27-82-04 

Valve, Two Speed, Slat 

27-82-05 

Valve, Check, Press 

27-82-06 

Restrictor, 2- Way, Ctr Slat 

27-82-07 

Restrictor, 2-Way, Cutbd Slat 

27-82-08 

Restrictor, Slat Ret, Outbd 

27-82-09 

Valve, Check, -6 

27-82-11 

Cylinder, Slat 

27-83-01 

Mech Assy, Outbd Slat Drive 

27-83-02 

Mech Assy, Outbd Slat Drive 

27-83-03 

Mech Assy, Indb Slat Drive 

27-84-02 

Sensor, Position, Slat 

27-84-03 

Indicator, Pos, Slat 

27-85-01 

Actuator, Elec, Slat Cont 

32-24-01 

Switch, Ground Sensing 

34-11-01 

Pitot Tube 

34-11-02 

Valve, Selector, Static 

34-1 1 -03 

Plate Assembly, Static 
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ATA NO. 

NAME 

34-11-04 

Ports, Alternate, Static 

34-16-01 

Computer, Central Air Data 

34-16-02 

Probe, Total Air Temp 

34-16-03 

Switching Unit, Air Data 

34-18-01 

Indicator, TAT & Thrust Rtg 

34-18-03 

Computer, Thrust Rtg 

34-21-01 

Gyro, Directional 

34-21-02 

Valve, Flux 

34-21-03 

Coupler, Compass 

34-21-06 

Controller, Compass 

34-21-07 

Switching Unit, Compass 

34-23-01 

Gyro, Vertical 

34-23-02 

Indicator, Attitude Director 

34-23-03 

Unit, Attd Mon/Switching 

34-23-04 

Rack, Gyro Mounting 

55-21-01 

Elevator Assy, Outbd LH 

55-21-02 

Elevator Assy, Outbd RH 

55-22-01 

Elevator Assy, Inbd LH 

55-22-02 

Elevator Assy, Inbd RH 

55-22-03 

Elevator Assy, Inbd Dtch LH 

55-22-04 

Elevator Assy, Inbd Dtch RH 

55-41-01 

Rudder Assy, Upper Fwd 

55-41-02 

Rudder Assy, Upper Aft 

55-42-01 

Rudder Assy, Lower Fwd 

55-42-02 

Rudder, Assy, Lower Aft 

55-51-01 

Bearing, Hinge, Horiz Stab 

57-51-01 

Aileron Assy, Outbd LH 

57-51-02 

Aileron Assy, Outbd RH 

57-51-03 

Aileron Assy, Inbd LH 

57-51-04 

Aileron Assy, Inbd RH 

57-52-01 

Flap Assy, Cutbd LH 

57-52-02 

Flap Assy, Outbd RH 

57-52-03 

Flap Assy, Inbd LH 

57-52-04 

Flap Assy, Inbd RH 

57-53-01 

Flap Vane Assy, Outbd LH 

57-53-02 

Flap Vane Assy, Outbd RH 
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ATA NO. NAME 


57-53-03 

Flap Vane Assy, Inbd LH 

57-53-04 

Flap Vane Assy, Inbd RH 

57-54-01 

Spoiler Assy, #1 LH 

57-54-02 

Spoiler Assy, #1 RH 

57-54-03 

Spoiler Assy, #2 LH 

57-54-04 

Spoiler Assy, #2 RH 

57-54-05 

Spoiler A$sy, #3 LH 

57-54-06 

Spoiler Assy, #3 RH 

57-54-07 

Spoiler Assy, #4 LH 

57-54-08 

Spoiler Assy, #4 RH 

57-54-09 

Spoiler Assy, #5 LH 

57-54-10 

Spoiler Assy, #5 RH 

57-55-01 

Slat Assy, #1 LH 

57-55-02 

Slat Assy, #2 LH 

57-55-03 

Slat Assy, #3 LH 

57-55-04 

Slat Assy, #4 LH 

57-55-05 

Slat Assy, #5 LH 

57-55-06 

Slat Assy, #6 LH 

57-55-07 

Slat Assy, #7 LH 

57-55-08 

Slat Assy, #8 LH 

57-55-11 

Slat Assy, #1 RH 

57-55-12 

Slat Assy, #2 RH 

57-55-13 

Slat Assy, #3 RH 

57-55-14 

Slat Assy, #4 RH 

57-55-15 

Slat Assy, #5 RH 

57-55-16 

Slat Assy, #6 RH 

57-55-17 

Slat Assy, #7 RH 

57-55-18 

Slat Assy, #8 RH 

76-11-01 

Switch Cam Assy, Throttle 

76-11-02 

Clutch Assy, A/T Drive 

76-11-03 

Switch Cam Assy, Throttle 

76-11-04 

Switch Cam Assy, Throttle 

76-11-05 

Switch Assy, Throt T/0 & G/A 

76-11-06 

Switch, RTC #3 Eng 2 

77-32-11 

Cable Assy, Engine 

77-32-12 

Cable Assy, Wing Pylon 

77-32-13 

Cable Assy, Tail Pyi on 
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APPENDIX 4 

EXPOSURE TIME FOR PROBABILITY ANALYSIS 


In the course of conducting the RSSAS study, several questions were 
raised on the intended meaning and interpretation of certain phrases used by 
the FAA and industry groups to describe the exposure parameter over which a 
particular risk probability applies. Two phrases that have caused some 
confusion when used as modifers to a probability value are "per flight or 
flight hour," and "for each trial or hour of exposure." These two phrases 
are synonomous when applied to aircraft, and the former is more commonly 
used for that purpose. 

The following discussion attempts to accomplish three things: 

1. Explain the prevailing interpretation of these phrases. 

2. Point out that there is not international agreement on a standard- 
exposure-time parameter. 

3. Discuss the implications of the lack of a standard on probabilistic 
risk analyses of complex aircraft systems. 

To quantify the probability of an event occurring, one must define an 
exposure parameter (time, trials, cycles, etc.) over which the probability 
applies. For example, the probability that a coin will fall head-up in one 
toss is quite different from the probability that it will fall head-up once 
in 10 tosses. Although this appears obvious and almost trite, it can 
become a disturbing issue when exposure parameters are required for calcu- 
lating the probability of specific functional fault conditions occurring in 
sophisticated aircraft systems. 

It is necessary to first establish the exposure parameter for the 
undesired end-event of interest without regard for the elements that can 
contribute to causing the event. For aircraft, this parameter is usually 
expressed in terms of a flight or an increment of flight time. Regulatory 
agencies and industry groups worldwide have been, and still are, trying to 
reach agreement on a standard for end-event exposure parameters that can be 
used by all groups for validating system designs. 
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For systems that are critical for only a brief period during a flight, 
such as automatic landing systems, there is a consensus that the end-event 
exposure parameter is that brief time period during which the aircraft is 
at risk should certain functional fault conditions occur. 

For active control systems such as RSSAS or load alleviation systems, 
which may in the future be critical to the airworthiness of the airplane 
throughout the flight duration, not all parties agree on a standard exposure 
time, or whether a standard is necessary. A currently active ICAO study 
group is attempting to develop guidance material on the certification of 
automatic landing systems and automatic flight control systems. The following 
is from the minutes of the group's August 1978 meeting: 

"It was proposed and agreed by the Study Group that the 
probability definitions used in the United States should be 
included in the draft material as an Appendix because they 
differ in detail from those presently in the text. The Study 
Group was, however, informed that firstly the material adopted 
contains intermediate levels which are not defined in the U.S. 
documents. Secondly, the numerical probability values are 
expressed 'per hour of flight determined for the expected mean 
flight time 1 whereas the U.S. values are expressed 'per flight 
or flight hour'. Thus there is only direct numerical equivalence 
for aeroplanes with an average flight time of one hour, although 
actual differences will be small for the normal range of flight 
times. Therefore, the use of other probability definitions in 
the U.S. does not affect the applicability of the material 
because the probability levels are similar in the actual certi- 
fication of automatic landing systems." 

A note to members subsequent to that meeting elaborated further for consider- 
ation by the members: 

"The meaning of the term 'expected mean flight time' . . . was 
considered to need some clarification and consequently: 

(i) The term was amended to read 'expected mean flight time. 
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i.e., duration of average individual flight for the type of 
aeroplane concerned 1 . 

(ii) to further clarify this point, the second sentence of 

paragraph 1.4.1 of Appendix C was replaced by the follow- 
ing text (based on paragraph 2.8 of Attachment B to 
Study Note No. 15). 'The probabilities should be 
established as the risk per hour in a flight where the 
duration of the flight is equal to the expected mean 
flight time for type of aeroplane concerned. For example, 
in systems where the hazard results from multiple failure 
in the same flight, the numerical assessment must take 
account of the likelihood that this will occur in a flight 
of expected average duration. Similarly, in those cases 
where failures are only critical for a particular period 
of flight, the hazard may be averaged over the whole of 
the expected mean flight time.' " 

For a function that is critical for the entire flight length, it is 
clear that the end-event exposure time is a variable, since not all flights 
of a typical airplane are the same length. One might calculate an average 
risk by using the average flight time, as is suggested by the ICAO Study 
Group, or a worst-case risk by using the longest flight time possible for 
the particular aircraft type. The current FAA view is understood to be 
that one hour is the longest end-event exposure time that must be used in 
risk analyses of this type, but if the actual critical exposure time is less 
than one hour, the actual value may be used. The ICAO Study Group seems to 
agree on the latter point. This actual lessor value comes from the words 
"per flight." The upper limit of one hour results from the words "per 
flight hour." The risk probability thus arrived at is for one hour of 
exposure to the end undesired event. It is important to recognize that a 
probability calculated for one hour cannot be linearly extrapolated to 
longer times even though the expression "per hour" is used, unless there 
is no redundancy and there are no latent undetected failure modes in the 
system. 
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The following simple example may serve to illustrate the implication 
of the current interpretation. For an event that occurs ramdomly in time . 
at a reasonably constant rate (a), the probability (Q) that the event will 
occur in a specified time space (t = t 2 -t-|) may be expressed as: 

Q = 1 - e' U , 

if it is known that the event has not occurred prior to t-j . For small values 
of At, this expression may be closely approximated, for simplicity, by: 

Q« At 

If a device has a known failure rate of, say, nine failures per million hours, 
and two of these devices are used in parallel so that both must fail before 
a critical function is lost, the probability (Qp) of losing the function is: 

q f = Q d x Q d = q2 = (A d t)2 = (9 x 10 " 6 ) 2t2 = t 8 - 1 x io- ] V 

If this function is required for only a short time, such as during an auto- 
matic landing, and both devices have been verified operating prior to 
engaging the critical flight phase, then the value of t is quite small, say 
about 10 minutes. The probability of losing this function during the 
critical time period is then: 

Q F = (8.1 x 10 -11 ) (^§) 2 = 2.3 x 10 -12 . 

Or, if this function is critical for one hour of the flight, 

Q F = (8.1 x 10" 11 ) (l) 2 = 8.1 x 10' 11 . 

For longer flight lengths, the probability will increase (in this example, 
as the square of the flight time), but the current FAA view is that such 
an increase for real systems will be well within the combined accuracy 
tolerances of the required probability and the data and assumptions used 
in the analysis, at least for values of t up to the average flight times 
of commercial aircraft. 

The advantage of specifying allowable risk levels on a "per-flight- 
hour" basis is that it allows comparing, analyzing, and certifying various 
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system configurations to a common standard that is independent of the 

mission range of the vehicles they may eventually be used on. Also, within 

reasonable limits, if the risk requirement is achieved with some margin, the 

effect of some increase in exposure time does not usually increase the risk 

to a value greater than the required certification value. In the above 

example the value of t can go to 3.5 hours before the threshold of 
-9 

1 x 10 is crossed. 

1 x 10~ 9 = (8.1 x lO-^t 2 
t = 3.5 hours 

Or, to view it another way, the device failure rate could be as much as 
3-1/2 times worse than was estimated for the one-hour case. 

1 x 10" 9 = (A ) 2 (l) 2 

A = 32 failures per million hours 

Further, when analyzing actual systems with significant redundancies at 
various levels, and several states of degradation or reconfiguration, several 
different exposure times are almost always required for various system 
elements to account for latent failures in redundant or intermittently used 
functions. The exposure time for potential failures of such elements is 
always conservatively taken as the time from when the element was last 
known to be functioning, to the time its operation is again verified. Even 
for automatic landing systems, with an end-event exposure time of only a 
few minutes for a flight, some elements within the system may have exposure- 
to-failure times of hundreds or thousands of hours. These times are 
applicable, for example, to devices whose failure could remain undetected 
until certain special tests are performed. Often these devices become the 
final constraint on the system risk level, so that the difference in the 
end-event risk between a one-hour flight and one several hours long is 
relatively small. 
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The potential impact of latent failures is recognized by all regulatory 
groups and industry. Below is another quotation from the material being 
developed by the ICAO Study Group: 

"Dormant Failures (latent) 

When the failure of a device can remain undetected in normal 
operation, the frequency with which the device is checked will 
directly influence the probability that such a failure is present 
on any particular occasion, this should be taken into account 
when assessing the probabilities of any failure conditions which 
include the dormant failures of monitoring devices or unchecked 
redundant items .' 1 

There are, of course, many additional important factors that must be 
considered in conducting a comprehensive safety assessment of any aircraft 
system. The preceding discussion is intended only to clarify, and perhaps 
justify, the prevailing interpretation of the term "pet flight or flight 
hour" as used by the FM* 
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APPENDIX 5 

NETWORK RELIABILITY ANALYSIS MODEL RESULTS FOR RSSAS 

The methodology associated with the computer program results contained 
in this appendix is discussed in Paragraph 4. 2. 2.1. 

Case 1 

Triple-Redundant Computers 

All elements operative at start of 1-, 2-, and 5-hour flights. 

Case 2 

Triple-Redundant Computers 

Maximum number of elements inoperative at start of 1-, 2-, and 
5-hour flights. 

Case 3 

Dual Computers 

All elements operative at start of 1-, 2-, and 5-hour flights. 

Case 4 

Dual Computers 

Maximum number of elements inoperative at start of 1-, 2-, and 
5-hour flights. 
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NETWORK RELIABILITY ANALYSES PROGRAM 

RSSAS RELIABILITY ANALYSIS (CONE II MCDONNELL -DOUGLAS CORP. 

FLIGHT TIME I. 00 HRS. RUN DATE 01/18/79 


CODE 

FUNCTION LOST 


PROBABILITY OF FAILURE 

A 

RSSAS ONLY 


0. 259E-09 

AA 

RSSAS ALL FUNCTIONS 


0. 272E-09 

B 

YAW DAMPER 


0.858E— 07 

c 

STALL WARNING 


0. 258E-05 

D 

ELEVATOR LOAO FEEL 


0.970E-07 

E 

FLAP LIMltlNG 


0. 970E-07 

ALL 

ALL FUNCTIONS 


0.180E-10 

A AB 

RSSAS AND YAW DAMPER 


0.245E-09 



CASE 1, ONE HOUR 

N F 

TWORK RFLIAB 

I L I T Y 

ANALYSIS PROGRAM 

RSS AS RELIABILITY ANALYSIS (CONF 1) 
FLIGHT TIME 2.00 HRS. 

MCDONNELL-DOUGL A S CORP i 
RUN DATE 01/18/79 

CODE 

FUNCTION LOST 


PROBABILITY OF FAILURE 

A 

RSSAS ONLY 


0.107F-D8 

AA 

RSSAS ALL FUNCTIONS 


0. 118E-08 

R 

YAW DAMPER 


0.343E-06 • 

C 

STALL WARNING 


0. 552E-05 

D 

ELEVATOR LOAO FEEL 


0.388E-dfc 

E 

FLAP LIMITING 


0.388E-06 

ALL 

ALL FUNCTIONS 


0. 144E-09 

AAB 

RSSAS AND YAW OAMPFR 


0. 106E-08 



CASE 1, TWO HOURS 

N F 

TWORK RELIAB 

I L I T Y 

ANALYSIS PROGRAM 

RSSAS 
FL I GHT 

RELIABILITY ANALYSIS (CONF 11 
TIME 5.00 HRS. 

MCDONNELL -DOUGLAS CORP. 
RUN DATE 01/18/79 

CODE 

FUNCTION LOST 


PROBABILITY OF FAILURE 

A 

RSSAS ONLY 


0.737E-08 

AA 

RSSAS ALL FUNCTIONS' 


0. 898E-08 

B 

YAW DAMPER 


0.214E-05 

C 

STALL WARNING 


0.165E-04 

0 

ELEVATOR LOAD FEEL 


0.242E-05 

E 

FLAP LIMITING 


0.242E-05 

ALL 

ALL FUNCTIONS 


D.222E-08 

AAB 

RSSAS AND YAW DAMPER 

. , f 0.810E-08 

case i, five hours 
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PROGRAM 


NETWORK RELIABILITY 

RSSAS RELIABILITY ANALYSTS (CONE 1) 

FL I GHT TIME 1.00 HRS. 


CODE 

COMPONENT 


probability of failure 

XI 

VERTICAL GYROl 


0.5106-03 

X 2 

VERTICAL GYR02 


0.510E-03 

XT 

VERTICAL GYR03 


0.510E-03 

X4 

ANGLE OF ATTACK 1 


0. 3306-03 

X 5 

ANGLE OF ATTACK 2 


0.330E-03 

X6 

AIR DATA COMPUTFR 1 


0.100E-03 

X7 

AIR DATA COMPUTER 2 


0. 100E-03 

xa 

YAW RATE GYRO 1 


0.860E-04 

X9 

YAW RATE GYRO 2 


0. 860E-04 

XIO 

FLAP POSITION 1 


0.200E-05 

X 11 

FLAP POSITION 2 


0.200E-05 

X12 

SLAT POSITION 1 


0.610E-04 

X 13 

SLAT POSITION 2 


0.6106-04 

X14 

SCDP1 (ALL FUNCTIONS) 


0.8006-04 

X 1 5 

SC0P2 (ALL FUNCTIONS) 


0.8006-04 

Xlfc 

SCO 0 3 (ALL FUNCTIONS) 


0.8006-04 

Y 1 A 

SC0P1 (RSSAS ONLY) 


0.625E-04 

Y15 

SCOP 2 (RSSAS ONLY) 


0.6256-04 

Y 16 

SC0P3 (RSSAS ONLY) 


0.6256-04 

X 17 

CPU1 (ALL FUNCTIONS) 


0.2606-03 

X 1 8 

CPU2 (ALL FUNCTIONS) 


0 .2606-03 

X 19 

CPU3 (ALL FUNCTIONS) 


0.2606-03 

Y17 

CPU! (RSSAS ONLY) 


0.1886-03 

Y 18 

CPU 2 (RSSAS ONLY) 


0 • 188E-03 

Y19 

CPU3 (RSSAS ONLY) 


0.1886-03 

X 20 

STICK SHAKER 


0.240E-05 

X 3 1 

RUn'OER ACTUATOR 1 


0.5006-05 

X22 

RUDDER ACTUATOR 2 


0.5006-05 

X 23 

ELEVATOR ACTUATOR 1 


0.5006-05 

X24 

ELEVA T OR ACTUATOR 2 


0.5006-05 

X 2 5 

ELEVATOR LOAD FEEL ACTUATOR 1 


0.3516-04 

X 26 

ELEVATOR LOAD FEEL ACTUATOR 2 


0.350E-04 

X27 

FLAP LIMITER ACTUATOR 1 


0.3506-04 

X28 

FLAP LIMITER ACTUATOR 2 


0.3506-04 

X 79 

ehv,mod,lvot,ano S.O.V. 1 


0.900E-05 

X30 

EHV. MOD .LVDT.AND S.O.V. 2 


0.900E-05 

X 3 1 

FHV.MOD.LVDT.AND S.O.V. 3 


0. 900E-05 

X32 

FHV.MOO.LVDT.aND S.O.V. 4 


0.9006-05 

X 33 

HYD. SYSTEM 1 


0.1506-04 

X 34 

HYD. SYSTEM 2 


0. 150E-04 


COMPONENT HOURLY FAILURE PROBABILITIES 


ANALYSIS 

MCDONNELL-DOUGLAS CORP 
RUN DATE 01/18/7 
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i 


• O' 


NETWORK RELIABILITY 

RSSAS RELIABILITY ANALYSIS (CONF II 
FL IGHT TmF 1.00 HRS. 


CODE FUNCTION LOST 


ANALYSIS PROGRAM 

MCDONNELL -DOUGL AS CHRP. 
RUN DATE 01/18/79 


PROBABILITY OF FAILURE 


A R SSAS ONLY 

AA R SSAS ALL FUNCTIONS 

B YAW DAMPER 

C STALL WARNING 

D ELEVATOR LOAD FEEL 

E FLAP LIMITING 

ALL ALL FUNCTIONS 

AAB R SSAS AND YAW DAMPER 


0.255E-06 

0.294F-06 

0.366E-03 

0.395E-03 

0.295E-03 

0.295E-03 

0.740E-07 

0.859E-07 


CfSE 2, ONE HOUR 

NETWORK RELIABILITY analysis PROGRAM 

RSSAS REL IABIL ITY ANALYSIS CCONF II MC DONNELL -DOUGL AS CHRP. 

FLIGHT TIME 2.00 HRS. RUN DATE 01/18/79 


CODE FUNCTION LOST PROBABILITY OF FAILURE 


A 

RSSAS ONLY 


0. 102E-05 

AA 

RSSAS ALL FUNCTIONS 


0.117E-05 

B 

YAW DAMPER 


0.732E-03 

C 

STALL WARNING 


0.791E-03 

0 

ELEVATOR LOAO REEL 


0.590E-03 

E 

FLAP LIMITING 


0.590E-03 

AIL 

ALL FUNCTIONS 


0.296F-06 s 

AAB 

R SSAS AND YAW DAMPER 


0.344E-06 



CASE 2, 

TWO HOURS 

N F 

TWORK RELIAB 

I L * 

TY ANALYSIS PROGRAM 

RSSAS 
FL IGHT 

RELIABILITY ANALYSIS (COW 1» 
TIME 5.00 HRS. 

MCDONNELL -DOUGL AS CORP. 
RUN DAT F 01/18/79 

CO OF 

FUNCTION LOST 


PROBABILITY OF FAILURE 

A 

RSSAS ONLY 


0.637E-05 

AA 

RSSAS ft LL FUNCTIONS 


0.734E-05 

B 

YAW DAMPFR 


0 • 183F-07 

c. 

STALL WARNING 


0.198F-02 

0 

ELEVATOR LOAD FEEL 


0.148E-D2 

E 

FLAP LIMITING 


0.148 E— 02 

ALL 

ALL FUNCTIONS 


0 • 185E-05 

AAB 

RSSAS AND YAW DAMPER 


0.216E-05 


CASE 2, FIVE HOURS 
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NETWORK RELIABILITY ANALYSIS PROGRAM 

RSSAS RELIABILITY ANALYSIS (CONF 1) MC DONNELL -DOUGL AS CORP. 

a IGHT TUF 1.00 HRS. RJN DATE 01/18/79 


CODE 

COMPONENT 

PROBABILITY OF FAILURE 

XI 

VERTICAL GYPOl 

0.510E-03 


X2 

VERTICAL GYR02 

0.510F-03 


XT 

VERTICAL GYR03 

0 • 510E-03 

TNOP 

X4 

ANG. F OF ATTACK l 

0.330E-03 


X5 

ANGLE OF ATTACK 2 

0.330F-03 

TNOP 

X 6 

AIR DATA COMPUTER 1 

0.100E-03 


X7 

AIR DATA COMPUTER 2 

0. 100E-03 


X 8 

YAW RATE 5 YR 0 1 

0.860E-O4 


X9 

YAW RATE GYRO 2 

0.8606-04 

INOP 

X10 

FLAP POSITION 1 

0. 2006-05 


XI 1 

EL A* POSITION 2 

0.200E— 05 

INOP 

X 1 2 

SLAT POSITION 1 

0.610F-04 


X13 

SLAT POSITION 2 

0.610E-04 

TNOP 

X 1 A 

SCDP1 (ALL FUNCTIONS) 

0.800E-04 


XI 5 

SCO* 2 (ALL FUNCTIONS) 

0.800F-04 

IN OP 

X 1 6 

SCOP 3 (ALL FUNCTIONS) 

0.800E-04 


Y 1 A 

SCO> 1 (R SSAS ONLY) 

0.625E-04 


Y 1 5 

SCO* 2 (RSSAS ONLY) 

0.625E-04 

INOP 

Y16 

SCO* 3 (R SSAS ONLY) 

0.625E-04 


X 17 

CPU1 (ALL FUNCTIONS) 

0.2606-03 


X 1 8 

CPU2 (ALL FUNCTIONS) 

0.260E-03 

INOP 

XI 9 

CPU3 (ALL FUNCTIONS) 

0.260E-03 


Y17 

CPU1 (RSSAS ONLY) 

0. 188E-03 


Y 18 

CPU2 (RSSAS ONLY) 

0.188E-03 

INOP 

Y19 

CPU3 (RSSAS ONLY) 

0 . 188F-03 


X20 

STICK SHAKFR 

0.240E-05 


X21 

RUDDER AC TUA TOR l 

0.500E-05 


X22 

RUODER ACTUATOR 2 

0 • 500E-05 

INOP 

X23 

ELEVATOR ACTUATOR 1 

0. 500E-05 


X24 

ELEVATOR ACTUATOR 2 

0.500F-05 


X2 5 

ELEVATOR LOAD FEEL ACTUATOR 1 

0.351F-04 


X26 

ELEVATOR LOAD FEEL ACTUATOR 2 

0.350E-04 

IN OP 

X27 

FLAP LIMITFR ACTUATOR 1 

0 . 350E-04 


X28 

FLAP LIMITFR ACTUATOR 2 

0 • 350E-04 

INOP 

X 29 

EHV.M30.LV0T.AND S.O.V. 1 

0.900E-05 


X 30 

EHV»MOD*LVDT,AND S.O. V. 2 

0.900E— 05 


X31 

FHV, M3D.LVDT.AND S.O.V. 3 

0.900F-05 


X32 

EHV.M3D.LVDT.AN0 S.O.V. 4 

0.900F-05 


X33 

HYD. SYSTEM 1 

0 . 150E-04 


X3 A 

HYD. SYSTEM 2 

0 . 150E-04 



COMPONENT HOURLY FAILURE PROBABILITIES WITH CASE 2 INOPERATIVE COMPONENTS NOTED 
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N u 1 woKN. NcLAAolLl f Y ANALYSIS PROGRAM 

KbASS RtLAAtiLilr AMAuYSid ttUNF Cl MCDGNNtLfc-OUOGLAS CORP. 

|-Liuh| IcHl i.Gu tiki. RUN DAT b Gl/16/79 


LUDc: 

t-L.NLli.Ul* LUST 

PKUbAbi Li TY GF FAILURE 

A 

nSsaS unlY 

G.414fc-07 

AM 

KSSAS ALL FUNLTiDNS 

0.7&6fc-CT7 

b 

If Art OAMPfcK 

C.9c2fc-G7 

L 

STALL MAKNaNu 

G.2S9fc-0i» 

D 

tLtVAlUK load Full 

G.103E-UO 

fc 

tLAF diMiliNG 

0.l03t-06 

AlL 

ALL FuNGTiuNS 

0.740t-G7 

AAtS 

KSSAS AND If Art UAMPtK 

U.742fc-07 


C^SE 3, 

ONE HOIJR 

N t 

IrtUKK KfcLiAbiLil 

Y ANALYSIS PkUGkAM 

KbAbS KtLi ADA Li t V ANAL V did (CfjNF C) 
FLIGHT liMfc c.bU HhS. 

mcuunnlll-duuglas cokp. 

RUN DAI fc LA/A6/7V 

CGofc 

FUNCTION LUsl 

PRUbAdiUTY GF FAiLUkL 

A ' 

KSSAS ONLY 

P.lbbt-Gb 

AA 

KSSAS AuL FdNL 1 ioNS 

U.3O7t-0b 

b 

Fan DAMPfck 

D.dGVt-Ob 

C 

STALL WARNING 

D«>5bfc—Gb 

u 

tfcfcVATUK LOAD FfcfcL 

G.^lA-fc-Ub 

fc 

FLAP LIMITING 

G,4lAfc-0b 

ALL 

ALL ItUNlT AUNb 

U.296fc-0to 

AAb 

kSSAb AND YAW DAMPfck 

0.297fc-06 


CASE 3, 

TWO HOURS 

N fc 

1 M G K R RtLAAblLlT 

Y ANALYSIS PROGRAM 

RSASS 

FLIGHT 

kbLiAbiLiTY ANALYSIS iCUNF fci 
TAMfc b.uU HKS. 

MCOUNNtLL— DUUGLAS LUKP. 
RUN DAT It 01/16/79 

CUDfc 

FUNGI ION LOST 

PRUbAblfclT Y OF FAILURE 

A 

kSSas unlit 

0.1U3t-U3 

AA 

KSSAS ALL FUNCTIONS 

0.1920-06 

o 

YAM DAMPfck 

0.230fc-Ui> 

C 

SlALfc WANNING 

D.it>7c-U4 

D 

LLEvaTOK LGaU Fc t L 

u.268t— 06 

fc 

FLAP Line i AND 

0.268 fc— Dd 

ALL 

ALL FUNCTAGNS 

U.166E-06 

AAb 

KSSAS AND YAW DAMPfcK 

G.i6tofc-06 


CASE 3, FIVE HOURS 
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N E T W (1 R K RELIABILITY ANALYSTS PROGRAM 

PSASS RFL TAB IL TTY ANALYSTS (CONF 2) MCDONNELL -DO'JGL AS CHRP. 

FLIGHT T IX F 1.00 HRS. RIJN OAT E 01/10/70 


CO OF 

FUNCTION LOST 

PROBABILITY of failure 

A 

I SSAS ONI Y 

0.245F-06 

AA 

R SSAS ML FUNCTIONS 

0.281F-0A. 

B 

YAW DAMPER 

0.366E-03 

C 

STAt. WARNING 

0.3P5E-03 

0 

ELEVATOR LOAD FEEL 

0.20 5F-0? 

E 

FLAP LIMIttmg 

0.2<R5 c -03 

ALL 

AI L FUNCTIONS 

0.740F-07 

AAB 

R SSAS A NO YAW OAMPPR 

CASE 4, ONE HOUR 

0.7B6E-0T 

N -P 

TWORK RFLTARILI t Y ANAL 

YSIS PROGRAM 

PSASS 

PPL TABU TTY ANAl YSTS (C.ONF 2) 

MCDONNELL -OQUGL AS CORP. 

FL IGHT 

TTXf 2.00 HRS. 

PJN DATE 01/10/70 

CODE 

FUNCTION LOST 

probability of failurf 

A 

R SSAS ONLY 

0.9B1F-06 

AA • 

R SSAS ALL FUNCTIONS 

0.112F-0F 

B 

YAW DAMPFR 

0.732E-03 

C 

STALL WAPNTNG 

0.791E-03- 

0 

FLEVATOP LOAD FFFL 

0.590P-03 

F 

FLAP LIMITING 

0.590F-03 

ALL 

AIL FUNCTIONS 

0.2«6E-06 

AAB 

R SSAS AND YAW DAMPFR 

CASE 4, TWO HOURS 

0 .30 3F-06 

N F 

TWORK RELIABILITY ANAL 

YSTS PROGRAM 

RSASS 

PPL IABIL ITY ANALYST S (CONF 21 

MCDONNELL— DOUGl. AS CORP. 

FL IGHT 

T I X p 5.00 HRS. 

RUN OAT F 01/19/79 

CO OF 

FUNCTION LOST 

PROBABILITY OF FAILURE 

A 

R SSAS ONLY 

0.613F-05 

AA 

RSSAS ALL FUNCTIONS 

0.70 IE-05 

B 

V AW TAMPER 

0.1B3E-02 

c 

STALL WARNING 

0. 198E-02 

0 

EL EVA TOR LOAD FEEL 

0. 148E-02 

E 

FLAP LIMITING 

0. 148E-02 

ALL 

ALL FUNCTIONS 

0.185E-05 


AAB R SSAS AND YAW DAMPFR 0.190E-05 

CASE 4, FIVE HOURS 
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APPENDIX 6 

AUGMENTATION BLOCK DIAGRAMS 


This section contains block diagrams of all the initial control laws 
with the exception of those containing longitudinal acceleration. Material 
presented here is discussed in Section 5. 
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K, = 0.4098 K 0 = 3.651 K n = °-4963 

K 2 = 0.02289 K° = 0.4963 K 12 = -2.772 

K 3 = 0.009267 K g = -0.1922 K 13 = 0.00559 

K 4 = 0.29 K g = 0.00559 K 14 = 178.0 

Kg = 0.074 K 10 = 0.4498 


CONTROL LAW NO. 2 - CRUISE 



27 


























































«a 

(RAD) 


K 1 = 0.5514 
K 2 = 0.08297 
Kg = 0.31 

K 4 = 1 - 0/V TR.M 
K 5 = 1.18 

K 6 = 0.8086 


;io 

'll 

'12 


= 1.242 
> 1.1902 
= 7.302 
= 8.2718 
= 1.242 
= 1.1902 


CONTROL LAW NO. 7 - CRUISE 



V 

(RAD) 


K 1 = 0.6329 
K 2 = 0.02413 
Kg = -0.929 


K 4 = 0.0008611 
Kg = 0.000367 
K° = 0.25 


CONTROL LAW NO. 12 - CRUISE 
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K 1 = 0.6329 K 4 = 0.0008611 

kl = 0.0241 Kg - -0.9355 

Kg = 0.006599 Kg = 0.25 

CONTROL LAW NO. 13 - CRUISE 



K, = 0.5972 K g = 0.5612 

K 2 = 0.02301 Kg = 0.29 

Kg - 0.008966 k” = 1.0/V TR|M 

K 4 = 0.000094 

CONf ROL LAW NO. 14 - CRUISE 
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K 1 = 0.5924 Kg = 0.00391 K„ = 0.001728 

K 2 = 0.02287 = 0.001728 = 0.03718 

K 3 = 0.1239 Kg = -1.9899 K^g = 0.001728 

K^ = -0.0000445 Kg = 0.001728 K^ = 0.082 

Kg = 0.29 K^q = -0.1747 K,g = 565.0 


CONTROL LAW NO. 16 - CRUISE 
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«e 

(RAD) 


K, = 0.5952 
Kj » -0.00004517 
Kg = 0.6327 
K 4 = 0.29 

K 5 = 10/V TRIM 
Kg « 0.646 


K ? = 0.6465 
Kg = 0.6896 
Kg = 1.132 
K. 0 = 0.5183 
K n = -0.051718 
K 12 = 06896 


K 13 = 1.132 
K 14 = 0.719 
K 15 = 1.0355 
K 16 = 0.6896 
K 1? = 1.132 


CONTROL LAW NO. 1? - CRUISE 


8 e 

(RAD)' 


h 

(M/S)" 


THRUST ■ 




(DIMENSIONLESS) 


v 16 


M7 


K 1? S+ 1 





K 1 


S 2 + K 4 s + Kg 


S+K 8 




S 2 + KgS + K ? 


S+Kg 







K 2 


s 2 + Ki 0 s + Kii 


s + k 14 

1/Q\ i/C 



S 2 +Ki2 S + Ki3 


S+K 15 



(RAD) 


K, = 0.5572 
K 2 = 0.000353 
Kg = 0.29 
K 4 = 0.4 

Kg = 1.0161 

Kg = 2.044 


K ? = 2.134 
Kg = 1.69 
K° = 0.04998 
K^g = 1.048 
K^ = 1.172 
K^ 2 = 2.044 


K 13 = 2.134 
K^ 4 = -0.0289 
K^g = .0.04998 

K^g = 0.06 

K^° = 10.0 


CONTROL LAW NO. 20 - CRUISE 
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«e 

(RAD) 


K 1 = 0.587 
K 2 = 0.0004032 
K 3 = 0.37 
K 4 = 1.08 
K c = 0.5116 
4 = 0.2 


K y = 0.02134 
Kg = 1.144 
Kg * 2.327 
K 1q = 1.1 
K n = 0.844 


K 13 = 0.02134 
K 14 = 0.466 
K 15 = 2.327 


CONTROL LAW NO. 26 - CRUISE 



5 g 

(RAD) 


K. = 0.5858 

K 2 = 0.5623 

Kg = 0.02289 

K", = 0.29 
4 


= 1.0/V 
= 5.82 
= 0.5 


TRIM 


CONTROL LAW NO. 27 - CRUISE 


277 





































































(RAD) 


THRUST 

(DIMENSIONLESS)' 


■ S+K 6 
S+ K-, 


S + K, 
S + K, 


0 ^ 

k 2 


s 2+ k 10 s + k 11 


(RAD/S) 


S 2 + K 12 S + k 13 

+J 




§ 

6 .. * 

K 3 


s 2 +k 14 s + k 15 

(RAD) ^ 


s 2 +k 16 s + k 17 




K 1 = 0.674 
K 2 = -4.7877 
Kg = 0.04 
K 4 = 0.303 
Kg = NOT USED 
Kg = 0.58 


K ? = 5.7 
K„ = 0.15 
K g = 0.415 
K^ = 0.8354 
IS 11 =_0-200717 
K 1 ^ = 6.115 


K 13 = 2.366 
K 14 = 1.062 
K,g = 0.5049 
K 16 = 6.115 
K 1? = 2.366 


CONTROL LAW NO. 2 - APPROACH 


e c 

(RAD) 


a 

(RAD) 


e 

(RAD/S) 


e 

(RAD) 


THRUST 
(DIMENSIONLESS) 



(RAD) 


K 1 “ 
k 2 = 

K 3 = 
K 4 = 


0.674 

K g = NOT USED 

K 9 = 

0.2976 

Kg = 0.28 

K 10 

K 11 

K 12 

0.1172 

K° = 0.14 

0.04 

Kg » 0.10 


= 0.10 
= 0.36 
= 0.10 


CONTROL LAW NO. 3 - APPROACH 
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(RAD) 


IAS 

(M/S) 


e 

(RAD/S) 


0 

(RAD) 


THRUST 
(DIMENSIONLESS) 



J e 
(RAD) 


K 1 = 
k 2 = 

K 3 = 
K 4 = 


0.6584 

K 5 = 0.29 

** 

K 10 

= 1.447 

-0.08 

Kg = 10/V TR(M 

= 0.5246 

0.1182 

K ? = 2.716 

*11 

K 12 

= 0.5799 

0.04 

Kg - 0.5246 

= 0.5246 


CONTROL LAW NO. 4 - APPROACH 



«e 

(RAD) 


K 1 = 0.6457 

K 2 = 0.3816 

Kg = 0.20 

= 0.0356 

K? = 0.000318 
5 


K 6 = 0.07758 
K^ = 0.0227 
Kg = 1.385 
Kg = 1.80 
K^ = 0.0478 


K n = -0.0008052 
K.j 2 = 0.07758 
K^g = 0.0227 
K^ = 0.0024 
K 15 = 50.0 


CONTROL LAW NO. 5 - APPROACH 
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Up 

e c 

(RAD) 


e 

(RAD/S) 


6 

(RAD) 


A N 

(M/S 2 ) 

• 

h 

(M/S) 


THRUST 

(DIMENSIONLESS) 



(RAD) 


K. = 0.6687 K 4 = -0.000359 

K 2 = 0.1161 Kg = -0.000529 

Kg = 0.4504 Kg = 0.31 

CONTROL LAW NO. 12 - APPROACH 



K 1 = 0.6687 K 4 = -0.000359 

K j = 0.1161 Kg = 0.4116 

Kg = 0.03879 K° = 0.32 

CONTROL LAW NO. 13 - APPROACH 
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Se 

(RAD) 


K 1 = 0.684 
K 2 = 0.1216 
Kg = 0.04230 


K 4 = 0.0006827 K ? = 10/V TR|M 

Kg = -0.2297 
K° = 0.32 


CONTROL LAW NO. 14 - APPROACH 



«e 

(RAD) 


K 1 = 0.674 K 4 = -0.000345 K ? = 1.0/V TR|M 

K 2 = 0.118 Kg = -0.07996 

Kg = 0.308 Kg = 0.31 

CONTROL LAW NO. 15 - APPROACH 
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CM CO <* 


Ua 

e c 

(RAD) 


6 

(RAD/S) 


e 

(RAD) 


h 

(M/S) 


THRUST 

(DIMENSIONLESS) 



5e 

(RAD) 


= 0.674 

K 5 = NOT USED 

*9 

= 0.116 

Kg = 0.28 

K 10 

= 0.3084 

K 7 = 0.284 

K 11 

= -0.000419 

Kg = 0.20 

K 12 


0.329 

0.20 

0.255 

0.20 


CONTROL LAW NO. 16 - APPROACH 



°e 

(RAD) 


= 0.6809 

K 5 = 10/V TRIM 

K 9 

= 0.3584 

= -0.0003578 

Kg = 0.467 

K 10 

= 0.46 

= -0.08078 

K° = 0.01603 

K 11 

= -0.002325 

= 0.313 

K a = 0.568 


= 0.568 


CONTROL 

LAW 

NO. 19 - APPROACH 


K 13 = 0.3584 
K 14 = 0.4655 
K 15 = 0.01245 
K 16 = 0.568 


K 1? = 0.3584 
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= 0.6809 

Kg = 0.003526 

K 9 

= -0.01664 

= -0.0003487 

K g = 0.533 

K 10 

= 0.533 

= 0.3 

K° = 0.3488 

K 11 

= 0.3488 

= 0.4382 

K g = 0.4277 

K 12 

= -0.0003 


CONTROL LAW NO. 20 - APPROACH 



= 0.6495 

Kg = 0.006816 

K 9 

= -0.1879 

= 0.000326 

K° = 0.20 

K 10 

= 0.20 

= 0.3 

K^ = 0.1757 

K 11 

= 0.1757 

= 0.10 

Kg = -0.659 

K 12 

= 0.0005 


CONTROL LAW NO. 26 - APPROACH 
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«e 

(RAD) 


K, = 0.6584 
Kj = -0.08007 

Kg = 0.11818 

= 0.31 


K 5 = 2'°i V TRIM 
Kg = 2.9897 

K° = 0.5246 

Kg = 1.4474 


Kg = 0.5246 
K 19 = 0.0658 


CONTROL LAW NO. 27 - APPROACH 


5 , 


'c 


(RAD) 






*1 

1 



THRUST -► 

(DIMENSIONLESS) 



K 1 = 0.6826 
K 2 = 0.4524 
K 3 = 0.1179 
K 4 = 0.33 


Kg = 0.3942 
K° = 0.2333 
K° = 0.1205 
Kg = 0.2195 


K g = -0.643 
K 1q = 0.1486 
K,, = 0.4528 
K 12 = 0.0512 


CONTROL LAW NO. 28 - APPROACH 
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K, - 0.6708 
K 2 - 0.1164 
K. - 0.03896 
K 4 - -0.0003699 


CONTROL LAW NO. 29 - APPROACH 


K_ - 0.31 Kg - 0.0307 K., - 0.0307 

Kg - 0.0006 K. 0 - 0.07616 K.> - -0.0106 

K, - 0.0307 K n - 0.0307 K« - 30.0 

Kg - 3.426 K{ 2 - 1.4474 















o 


THRUST — *H 
(DIMENSIONLESS) 

K. - 0.6868 
K- - -0.0016 

K 3 - 0.00806 

K 4 - 0.26 


J* * KflS.t K in 

S 2 + Ki, S + K 6 


S 2 + K ia 6+.K 14 +, 


s +k 16 S + K l6 


Kg - 0.62 

Kg - 0.0736 
K ? - 1.20 
Kg - 1.17 


k a - B.6419 

*,! “ 

K„ " .» 

K I - 1.17 


K -3 - 0.6591 
K . 4 - -0.00267 
- 1.20 
- ,. 1 ! 


CONTROL LAW NO. 31 - APPROACH 



TMftl l<;T 
(DIMENSIONLESS) 


K. - 0.6633 
K- - -0.00123 
K- - 0.8412 
K? - 0.32 


Kg - 0.6267 


K 13 - 0.6216 
K . 4 - 0.604 
K.g - 0.3386 
K 16 - 0.930 


CONTROL LAW tiO. 32 - APPROACH 












APPENDIX 7 

FINAL AUGMENTATION CONTROL LAW EQUATIONS 

This section contains the control laws expressed in difference equation 
form. The gain program for each control law used in the DETAC simulation 
is also provided. The rationale leading to the formulation of control laws 
in difference equation form is presented in Section 5. 

Control Law Equations 

The control law equations for all the final control laws are provided 
on the following pages. 
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FLIGHT CONDITION -CRUISE 

U = 0.0026545 V + 0.1 14689 ce + 0.022874 0 + 0.009265 0 

FEED FORWARD GAIN = 0.5 CROSSFEED GAIN - 0.29 

APPROACH 

U = 0.0010931 V + 0.268279 a + 0.118027 0* + 0.04004 0 

FEED FORWARD GAIN = 0.64 CROSSFEED GAIN - 0.31 
UNITS: M/SEC. RADIANS 

EET CONTROL EQUATIONS - LAW NO. 1 


PX1 = EXP (-10.0 . DT) 
PX2 - EXP (-0.1 ♦ DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 

Z2 = Z2 * PX2 + ML14514 f uV + 1.27104 * THRUST - J.36985 * a + 7.86 + S - 0.411 J • d 
U = 0 00091 * Z1 + 0.63 * Z2 — 0.11387 * a + 0.02288 * 0 + 0.00926 * 6 + 0.29 » THRUST 
FEED FORWARD = 0.5 


(1 - PX2) 


APPROACH 

U1 = 0.674 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * (1 - PX1 ) 

Z2 = Z2 * PX2 + (-0.11822 * U1 + 1.17898 * THRUST - 1.52104 
U = - 0.00009 * Z1 - 0.07996 * Z2 + 0.29757 * a + 0.11803 * $ 
FEED FORWARD = 0.674 


. a + 2.477 * 0 - 1.303 * 0) * (1 
+ 0.04 * e + 0.31 » THRUST 


- PX2) 


EET CONTROL EQUATIONS - LAW NO. 3 


PX1 •- EXP (-10.0 » DT) 
PX2 = EXP (-0.3 * DT) 
PX3 = EXP (—0.1 ♦ DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 

Z1 = Z1 * PX1 + U1 » (1 — PX1) . 

Z2 = Z2 * PX2 + (4.57327 * U1 + 0.15288 * THRUST + 3.7377 * e -0.49 * 6) * (1 - PX2) 

Z3 = Z3 * PX3 + (-5.25964 • U1 - 3.03405 * THRUST - 0.84122 4 +1.455 * 0) » (1 - PX3) 

U = -0.01503 ♦ Z1 + 0.06645 * Z2 - 0.11245 * Z3 + 0.06119 4 + 0.00926 0 + 0.29 * THRUST 
FEED FORWARD = 0.5 

APPROACH 

U1 = 0.674 * PILOT COMMAND + .U 

Z1 = Z1 . PX1 + U1 * (1 - PX1 ) , 

Z2 * Z2 * PX2 + (72.22104 * U1 - 21.81726 * THRUST + 15.23787 *0 - 0.5876 0) * (1 - PX2) 

Z3 = Z3 * PX3 + (143.577 * U1 - 42.22785 * THRUST + 50.72387 * 8 - 1.93338 0) * (1 - PX3) 

U = - 0.17105 . Z1 + 0.29523 . Z2 - 0.3387 * Z3 + 1.54934 * 0 + 0.04 * 0 + 0.31 * THRUST 
FEED FORWARD = 0.674 

EET CONTROL EQUATIONS - LAW NO. 2 
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PX1 = EXP (-10.0 . DT) 
PX2 = EXP (-0.3 • DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * (1 - PX1 ) 

Z2 = Z2 * PX2 + (3.92 * U1 - 1.1792 * THRUST - 0.0122667 * V r + 3.643 * 0 - 0.005 * 6) * (1 - PX2) 

U = - 0.01349 * Z1 + 0.11471 * Z2 + 0.0026543 * V + 0.05766 * 8 +0.00926 * 6 + 0.29 * THRUST 

FEED FORWARD = 0.5 

APPROACH 

U1 = 0.674 . PILOT COMMAND + U 

Z1 = Z1 * PX1 + 1.493 * U1 * (1 - PX1) , 

Z2 = Z2 * PX2 + (49.7775 * U1 - 15.03726 * THRUST - 0.0132705 * V + 10.586 * 0 + 0.034 0) * (1 - PX2) 

U = - 0.26831 * Z1 + 0.26831 * Z2 - 0.0011436 » V + 3.66227 * 0 + 0.04 0 + 0.31 * THRUST 
FEED FORWARD = 0.624 

EET CONTROL EQUATIONS - LAW NO. 4 


PX1 = EXP (—10.0 * DT) 
PX2 = EXP (-0.8 * DT) 
PX3 = EXP (-0.25 * DT) 
PX4 = EXP (-0.2 . DT) 


CRUISE 

U1 = 0.5 . PILOT COMMAND + U 
Z1 = Z1 • PX1 + U1 * (1 — PX1) 

Z2 = Z2 * PX2 + (-10,8726 » U1 + 2.05745 * THRUST - 1.83644 . a) • (1 - PX2) 

Z3 = Z3 » PX3 + (-79.918 * U1 + 4.31615 * THRUST - 18.297 * a) * (1 - PX3) 

Z4 = Z4 • PX4 + (79.777 * U1 - 1.38494 * THRUST + 22.18449 * a) . (1 - PX4) 

U = 0.01501 . Z1 + 0.15802 * Z2 - 0.1778 * Z3 - 0.14585 * Z4 + 0.21952 . a + 0.29 * THRUST 
FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 . PILOT COMMAND + U 
Z1 = Z1 . PX1 + U1 * (1 — PX1 ) 

Z2 = Z2 * PX2 + (-7.4035 . U1 + 2.0827.* THRUST - 0.71526 . a) * (1 - PX2) 

Z3 = Z3 * PX3 + (-147.064 * U1 + 46.4056 * THRUST - 7.395 * a) ♦ (1 - PX3) 

Z4 = Z4 * PX4 + (157.61 * U1 - 50.7887 * THRUST + 9.20378 * a) * (1 — PX4) 

U = 0.01519 * Z1 + 0.12673 * Z2 - 0.07174 * Z3 - 0.06469 * Z4 + 0.5598 * a + 0.31 » THRUST 

FEED FORWARD = 0,674 

EET CONTROL EQUATIONS - LAW NO. 5 


PX1 = EXP (-10.0 » DT) 
PX2 = EXP (-0.8 * DT) 
PX3 = EXP (-0.25 » DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * (1 - PX1 ) 

Z2 = Z2 * PX2 + (16.20791 * U1 - 8.026 * THRUST - 0.126874 * V + 2 279 * a) * (1 - PX2) 

Z3 = Z3 * PX3 + (-49.0785 * U1 + 20.786 * THRUST + 0.1579 * V - 7.52138 * a) . (1 - PX3) 

U - 0.00965 * Z1 - 0.00689 * Z2 + 0.00058 * Z3 + 0.0019674 * V + 0.11471 * a + 0 29 * THRUST 
FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * (1 - PX1 ) 

Z2 = Z2 * PX2 + (-1.28286 * U1 - 0.36578 
Z3 = Z3 * PX3 + (-3.77418 * U1 + 1.35225 
U = 0.01322 * Z1 - 0.00804 * Z2 + 0.14885 
FEED FORWARD = 0.674 


THRUST - 0.063231 * V - 0.00837 * a) * 
THRUST + 0.0058868 * V - 0.05624 * a) * 
Z3 - 0.00246356 * V + 0.26831 * a + 0.31 


(1 - PX2) 
(1 - PX3) 
* THRUST 


EET CONTROL EQUATIONS - LAW NO. 6 
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PX1 = EXP (-10.0 . DT) 
PX2 = EXP (-0.8 * DT) 
PX3 = EXP (-0.3 * DT) 
PX4 = EXP (-0.1 * DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 
Z1 = 21 * PX1 + U1 * (1 - PX1) 

Z2 = Z2 » PX2 + (-1.96557 * U1 + 3.96326 * THRUST + 0.0888095 . V) * (1 - PX2) 

Z3 = Z3 * PX3 + (12.4322 « U1 - 19.8386 * THRUST - 0.1896362 . V) » (1 - PX3) 

24 = Z4 * PX4 + (-62.14339 * U1 + 31.32692 * THRUST + 0.203358 » V) * (1 - PX4) 

U = 0.01029 * Z1 + 0.13913 * Z2 + 0.02504 ♦ Z3 - 0.00362 * Z4 - 0.00563762 * V + 029 * THRUST 
FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 * PILOT COMMAND + U 
Z1 = Z1 * PX1 + U1 * (1 - PX1 ) 

Z2 = Z2 * PX2 + (-2.77793 * U1 - 0.90596 * THRUST - 0.14683 1 * v) * (1 - PX2) 

Z3 = Z3 * PX3 + (81.6286 * U1 - 31.22271 * THRUST - 0.236749 » V) * (1 - PX3) 

Z4 = Z4 * PX4 + (-220.68686 » U1 + 76.0263 » THRUST + 0.123556 * V) * (1 - PX4) 

U = 0.00783 * Z1 + 0.027712 * Z2 + 0.2725 * Z3 + 0.278 * Z4 + 0.0725686 * V + 0 31 * THRUST 

FEED FORWARD = 0.674 


EET CONTROL EQUATIONS - LAW NO. 7 


PX1 = EXP (-10.0 * DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 
Z1 = Z1 * PX1 +U1 . (1 - PX1) 

U = 0.00736 * Z1 + 0.02284 * 0 + 0.00891 . 9 + 0.00101706 * (AN - 6.18744 * THRUST) 
+ 0.00234827 * V + 0.29 * THRUST 
FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 . PILOT COMMAND + U 
Z1 = Z1 * PX1 +U1 * (1 -PX1) 

U = 0.01464 » Z1 + 0.1 1981 « $ + 0.04168 . 9 + 0.0071 194 * (AN - 1.92469 » THRUST) 
-0.003096 * V +0.31 * THRUST 
FEED FORWARD = 0.674 

EET CONTROL EQUATIONS - LAW NO. 14 


PX1 = EXP (-10.0 * DT) 
PX2 = EXP (-0.8 * DT) 
PX3 = EXP (-0.3 * DT) 
PX4 = EXP (-0.1 • DT) 


CRUISE 

U1 = 0.5 * PILOT COMMAND + U 
Z1 = Z1 »PX1 +U1 * (1 -PX1) 

Z2 = Z2 * PX2 + (-9.8747 * U1 + 1.67371 » THRUST - 0.145632 * (AN -6.18744 * THRUST)) • (1 — PX2) 

Z3 = Z3 « PX3 + (-13.388 * U1 + 0.35893 . THRUST - 0.0241408 * (AN - 6.18744 . THRUST)) * (1 - PX3) 

Z4 = Z4 * PX4 + (9.00817 * U1 +4.01193 • THRUST + 0.07 14384 . (AN -6.18744 * THRUST)) . (1 -PX4) 

U = 0.02528 . Z1 +0.11535 . Z2 - 0.21582 * Z3 - 0.0949 * Z4 + 0.0016072 . (AN - 6.18744 * THRUST) 

+ 0.29. THRUST 
FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 * PILOT COMMAND + U ' 

Z1 = Z1 * PX1 + U1 . (1 — PX1) 

Z2 = Z2 » PX2 + (45.476 * U1 - 12.35196 . THRUST + 0.1 1441 . (AN - 1.925 . THRUST)) • (1 - PX2) 
Z3 = Z3 * PX3 +(-181.178. U1 +54.41 . THRUST - 0.20867 . (AN - 1.925 . THRUST)) . (1 — PX3) 
Z4 = Z4 » PX4 + (259.881 . U1 - 78.692 « THRUST + 0.882648 . (AN - 1 .925 . THRUST)) • (1 - PX4) 
U = 0.1 1707 . Z1 - 0.13954 . Z2 - 0.18646 * Z3 - 0.20546 . Z4 + 0.043328 . (AN - 1 .925 * THRUST) 
+ 0.31 .THRUST 
FEED FORWARD = 0.674 

EET CONTROL EQUATIONS - LAW NO. 26 
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PX1 = EXP (-10.0 * DT) 
PX2 = EXP (-0.3 * DT) 


CRUISE 

U1 = 0.5 » PILOT COMMAND + U 
Z1 = Z1 . PX1 + U1 # (1 -PX1) 

Z2 = Z2 * PX2 + (-1.00934 * U1 +0.19768 
« THRUST)) * (1 — PX2) 

U = 0.03705 * Z1 - 0.876 » Z2 + 0.07379 * 
* THRUST 

FEED FORWARD = 0.5 


* THRUST + 3.226 » S + 0.0026 » 8 - 0.0067568 * (AN - 6.189 
8 +0.00618 * 8 +0.008692 * (AN -6.189 * THRUST) +0.29 


APPROACH 

U1 = 0.674 . PILOT COMMAND + U 

Z1 = Z1 . PX1 -4.676 * U1 * (1 — PX1 ) . 

Z2 = Z2 * PX2 + (-15.33 » U1 + 14.38 * THRUST + 287.1 « 6 -20.687 * 8 - 1.788 ♦ (AN - 1.925 * THRUST)) 
* (1 — PX2) 

U = 0.4167 * Z1 +0.41495 . Z2 + 0.11705 * 8 + 0.03914 * 8 - 1.0404 « (AN - 1.925 * THRUST) +0.31 
. THRUST 

FEED FORWARD = 0.674 


EET CONTROL EQUATIONS - LAW NO. 29 


PX1 = EXP (-10.0 * DT) 
PX2 = EXP (-0.3 * DT) 
PX3 = EXP (-0.1 * DT) 


CRUISE 

U1 

Z1 

Z2 

Z3 

U 


0.5 * PILOT COMMAND + U 
Z1 ♦ PX1 + U1 * (1 - PX1) 

Z2 * PX2 + (172.656 * U1 - 49.0487 . THRUST + 0.2597 * (AN - 6.189 * THRUST) - 0.43039 » V) 
. (1 - PX2) 

Z3 * PX3 + (-509.375 . U1 + 148.39 • THRUST - 0.9095 » (AN - 6.189 * THRUST) + 1.29456 * V) 

• (1 - PX3) 

0.01458 * Z1 + 0.0066 * Z2 + 0.00839 * Z3 + 0.0092 » (AN - 6.189 * THRUST) + 0.002348 * V + 0.29 

* THRUST 

FEED FORWARD = 0.5 


APPROACH 

U1 = 0.674 » PILOT COMMAND + U 
Z1 = Z1 • PX1 + U1 * (1 - PX1 ) 

Z2 = Z2 * PX2 + (31.072 * U1 - 9.436 * THRUST + 0.03431 # (AN - 1.925 * THRUST) - 0.003697 * V) 
. (1 — PX2) 

Z3 = Z3 * PX3 + (-91.893 * U1 + 28.636 . THRUST - 0.2438 * (AN - 1.925 • THRUST) + 0.01126 * V) 
* (1 — PX3) 

U = 0.02541 . Z1 + 0.02305 . Z2 + 0.03773 . Z3 + 0.0059368 * (AN - 1.925 * THRUST) - 0.003096 *V 
+ 0.31 * THRUST 
FEED FORWARD = 0.674 


EET CONTROL EQUATIONS - LAW NO. 30 
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Gain Programs - DETAC Simulation Control Laws 


The gain programs for the Control Laws 1 through 7 which were used in 
the DETAC Simulation are provided below: 

Control Law No. 1 


VES=778.3 

Pi =0 . 0001 21 6*VES-0 . 04826 
P2=-0.0002852*VES+0. 33667 
P3=-0. 0000571 5*VES+0. 053745 
P4=-0. 0001 767*VES+0. 1604 
P5=-0 . 0021 2256*VES+1 8.272 
P6=-0. 0003231 2*VES+0 . 751 484 


Control Law No. 2 


Pl=1.0 

P2=-l . 2033662E-01 *VES+1 05 . 23596 
P3=2 . 3375975*VES-1 81 0. 5927 
P4=-2 . 1 355933E-02*VES+20 . 359 
P5=l. 812441 9E-04*VES-0. 63106235 
P6=-0. 276391 25*VES+209. 85567 
P7=4. 1 701 75*VES-341 9.4854 
P8=-9. 57568985-02*VES+73. 686374 
P9=6 . 2922562E-03*VES-3. 442263 
PI 0=2 . 89730735-04*VES-0. 24052743 
Pll =-4 . 2484679E-04*VES+0 . 39710826 
P12=4.2014856E-04*VES-0. 43945162 
PI 3=-2 . 7635097E-03*VES+2 . 21 20296 
P14=-5.1758774E-05*VES+0. 053746674 
PI 5=-2.11699165-03*VES+18. 267654 
P16=-3.2311977E-04*VES+0. 751 48412 


Control Law No. 3 


Pl=1.0 

P2=-4.9990714E-05*VES-0. 10623222 
P3=9.795077E-03*VES+65. 201718 
P4=2.8076137E-04*VES-1 .5883665 
P5=7 . 1 1 64345E-04*VES+2 . 3066779 
P6=l ,6441225E-03*VES-1 .6970705 
P7=l . 85701 02E-06*VES-5 . 3531 1 045-04 
P8=l . 31 8421 5E-03*VES-0. 3961 1 748 
P9=-7 . 6404828E-04*VES+0 . 48078877 
PI 0=-l . 7669452E-04*VES+0. 1 60401 34 
PI 1 =-5 . 71 58774E-05*VES+0. 053746674 
PI 2=-2 . 1 1 6991 6E-03*VES+1 8 . 267654 
PI 3=-3. 231 1 977E-04*VES+0. 751 4841 2 
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Control Law No. 4 


PI =-9.1 60631 35-04*VES+l .7129719 
P2=-8. 51 571 95E-02*VES+70. 1 98205 ' 
P3=l . 474481 6*VES-1 215.1 522 
P4=3. 2548245E-05*VES-0. 23968093 
P5=-l .28931 47E-02*VES+1 3. 677756 
P6=-7.2237697E-05*VES+0. 051212599 
P7=4 . 7320334E-04*VES-0 . 381 7841 6 
P8=-2.8523676E-04*VES+0. 33670977 
P9=l . 21 60471 E-04*VES-4 .82657755-02 
PI 0=-6 . 69379755-03*VES+5 . 2674426 
PI 1 =-5 . 71 587745-05*VES+0 . 053746674 
PI 2=-2 . 11 6991 65-03*VES+l 8 . 267654 
P13=-3.23119775-04*VES+0. 75148412 


Control Law No. 5 
Pl=1.0 

P2=(-0.0064421*VES-5. 8587391 ) 
P3=(-0. 00004694*VES+2 . 094 ) 
P4=(-0.0020818*VES-0. 216036) 

P5= (0.1 246553*VES-1 76 . 9425) 

P6= ( -0.0781 486*VES+65 .1395) 
P7=(-0.020233*VES-2. 5418102) 

P8= ( -0. 1 4449*VES+1 92 . 2391 5 ) 

P9= (0,091 731 *VES-72. 77957) 

PI 0= ( 0 . 0240859*VES+3 . 42675 ) 

PI 1 =-0. 000000351 5*VES+0 . 01 527859 
PI 2=0 . 000057984*VES+0 . 1 1 2885 
PI 3=-0. 0001 968869*VES-0. 0245289 
PI 4=-0 . 0001 50727*VES-0 .028543 
PI 5=-0 . 000631 8477*VES+0 .711 29008 
PI 6=-2.11699165-03*VES+18. 267654 
PI 7=-0. 0003231 2*VES+0 .75148 


Control Law No. 6 
Pl=1.0 

P2=3.2480538E-02*VES-9. 0716931 
P3=-0 .81 504921 *VES+1 74 . 491 1 5 
P4=-2 . 06501 75E-03*VES-0. 6096281 7 
P5=4. 2475851 E-03*VES-1 .0270368 
P6=-8. 41 3021 3E-02*VES+1 6 . 400245 
P7=2 . 0677381 *VES-41 8 . 36538 
P8=4.9325143E-03*VES-1 .0799593 
P9=-l . 3862841 E-02*VES+3. 2680693 
PI 0=-6 . 6295264E-06*VES+1 .480976E-02 
PI 1 =2 . 1 35561 7E-06*VES-8. 5521 077E-03 
PI 2=-2 . 7533895-04*VES+0 . 21 487626 
PI 3=1 . 43773255-04*VES-7 . 7522729E-02 
P14=-2.8523676E-04*VES+0. 33670977 
PI 5=-2 . 1 1 6991 6E-03*VES+1 8. 267654 
P16=-3. 2311 9775-04*VES+0. 75148412 
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Control Law No. 7 


Pl=1.0 

P2=l . 5085608E-03*VES-3 . 1 396828 ■ 

P3=0 . 51807 939*VES-1 76 . 1 431 2 
P4=7. 745531 25-03*VES-4. 4229271 
P5=0 . 1 2849526*VES+1 1 2 . 44002 
P6=0 . 211 2531 *VES-2079 . 388 
P7=l .5288068E-03*VES-4. 5033176 
P8=0 . 29441 684*VES-291 .28801 
P9=-4.7559634*VES- 5496. 4666 
PI 0=2 . 5860921 5-03*VES+l . 53871 85 
PI 1 =4 . 568245 1 5-06*VES+6 . 7345348E-03 

PI 2=-2 . 5624883E-04*VES+0 . 33856847 
PI 3=-4.5953574E-04*VES+0. 38269667 
PI 4=-5 . 2297121 E-04*VES+0 . 40340849 
PI 5=-2 . 5375425E-03*VES+1 .8764645 
PI 6=-2 . 1 1 6991 6E-03*VES+1 8. 267654 
PI 7=-3 . 231 1 977E-04*VES+0 . 751 4841 2 



APPENDIX 8 

AUGMENTED AIRCRAFT PERFORMANCE 

This section contains data demonstrating the correlation of the Augmented 
EET aircraft response to that of the DC-10 model for elevator perturbations. 
Control laws 1 through 7 are shown for both approach and cruise flight conditions. 
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EET CRUISE ^ AIRCRAFT 4 0 X CG C 0 N T . LAW £' ELEV-PERT 
+ DC10 CRUISE" AIRCRAFT 88 7. CG ELEV-PERT 


+.050000 



+.010000 + rjooodo +20.0000 +40.0000 +60.0000 +80.0000 +100.000 +180.000 +140.000 

STO 0EV = +.0070 3 8 TIME (SECONDS) 




COMPARISON OF BASELINE AND AUGMENTED EET IN CRUISE - CONTROL LAW NO. 2 
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EET CRUISE AIRCRAFT 40 K CG COAT LRU 3 ELEV-PERT 

H^ DCIO CRUISE AIRCRAFT £88 C-G’ ELEV-PERT 




COMPARISON OF BASELINE AND AUGMENTED EET IN CRUISE - CONTROL LAW NO. 3 
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EET CRUISE AIRCRAFT 40 ?! C G CONT. LAW 4 E LEV-PERT 
+ DC10 CRUISE AIRCRAFT £ 8 X CS ELEV-PERT 





COMPARISON OF BASELINE AND AUGMENTED EET IN CRUISE - CONTROL LAW NO. 4 
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COMPARISON OF BASELINE AND AUGMENTED EET IN CRUISE - CONTROL LAW NO. 5 
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EET CRUISE AIRCRAFT 4 0 X CS C 0 N T . LAW 6 ELEV-PERT 
^ DC10 CRUISE AIRCRAFT £ 8 C6 ELEV-PERT 



STD OEV » +.002689 TIME (SECONDS) 
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COMPARISON OF BASELINE AND AUGMENTED EET IN CRUISE - CONTROL LAW NO. 6 
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EET CRUISE RIRCRRFT 4 0 X CG CON T LAW 7 E LEV-PERT 
+ DC 10 CRUISE fi. I RCRflFT 2 81 CG ELEV-PERT 



COMPARISON OF BASELINE AND AUGMENTED EET IN CRUISE - CONTROL LAW NO. 7 
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VELOCITY <M/SEC) fit-PHR (FROIRNS) PITCH CRRDIRMS) 


EET APPROACH AIRCRAFT 4 0 K CG CONT LAW £ E LEV-PERT 
+ DC10 APPROACH AIRCRAFT £ 8 X CG E LEV-PERT 




COMPARISON OF BASELINE AND AUGMENTED EET IN APPROACH - CONTROL 
LAW NO. 2 
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COMPARISON OF BASELINE AND AUGMENTED EET IN APPROACH - CONTROL 
LAW NO. 4 
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APPENDIX 9 

CONTROL LAW SENSITIVITY 


This section contains data showing control law sensitivity to sensor 
input parameters which have other than nominal tolerance values. The 
method for establishing worst-case sensor tolerance is discussed in 
Section 5. 
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APPENDIX 10 

ADDITIONAL PROPOSED AUGMENTATION FUNCTION 

This section contains diagrams of other augmentation functions proposed 
for integration with RSSAS into the Flight Augmentation Computer, as discussed 
in Section 6. These functions include Yaw Damping, Turn Coordination, 

Elevator Load Feel Programming, Flap Limiting, and Stall Warning. The figures 
shown describe the existing DC-10 system architectures. 
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YAW DAMPER INTERFACE TABLE 


Inputs 


B. Outputs 

Analog 

2 Yaw Rate 

DC 

2 T- Valve Command 

2 Roll Attitude 

AC 


2 Rudder Position 

AC 


2 T-Valve Position 

AC 



29 VDC 

7 YR6 BITE 
2 Engage 
6 Overhead Test 
2 Engage Interlock 


2 V 6 Valid 
2 Land Interlock 

2 On Ground 

1 Inoperative 

3 YRG BITE 

2 Overhead Test 


Digital 

2 MACH (ADC) 1 Inter- Computer 

1 Maintenance 
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SIMPLIFIED SYSTEM SCHEMATIC - AUTOPILOT YAW AXIS 








ELF/FL INTERFACE TABLE 


Inputs 

Analog 

4 Tach FB 
2 Position FB 

28 VDC 


Digital 

2 Airspeed (ADC) 
1 Maintenance 

Power Servo 


B. Outputs 


AC 

AC 


2 Monitor 
2 Warning Lights 


1 Inter-Computer 


2 Actuator 
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STALL WARNING INTERFACE TABLE 


A. Inputs 
Analog 

2 Angle of Attack 

1 Flaps 

28 VDC 

2 Slats 

2 AOA Valid 
1 On Ground 


Digital 
1 Maintenance 


AC 

AC 


B. Outputs 


1 Slat 

2 Stick Shaker 
2 ADA Test 

2 SW Test Overhead 
1 Slat Test 
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SYSTEM SCHEMATIC - STALL WARNING 





APPENDIX 11 
EET ELECTRICAL SYSTEM 


The primary power system for the EET is a two-generator, 115/200-volt 
(at point of regulation in the electric power center), 3-phase (4-wire, grounded 
neutral), 400-Hz alternating current system. The two generators, one on each 
engine, are supplemented by an identical generator on the APU which is both 
ground and flight-operable. The main engine channels may be operated paralleled, 
unparalleled, or isolated. The system also provides emergency power, supplied 
by an air-driven generator and a battery. The APU generator or the external 
power supply is never paralleled with the main generators, or with each other. 

A 28-volt dc supply is derived from the ac system by transformer/rectifiers 
(see electrical system schematic). 

The airplane can be dispatched with one main generator channel inoperative, 
providing the APU generator channel is operative. 

The airplane can be dispatched with any one transformer/rectifier unit 
(except T/R-2) inoperative. 

No single fault can cause the loss of more than one generator channel. 

AC System Description 

The EET derives its electrical power from 90-kva, 120/208-volt, 3-phase, 
400-Hz, wye-connected brushless generators. The neutral of the wye connection 
is grounded to the airplane structure in each case. 

The two main ac generating channels of the basic system are designed to 
operate equally well paralleled, unparalleled, or isolated. Design prevents 
these channels from being paralleled with the external ground supply or the 
APU generator. 

The ac bus system is configured so that each main generator is connected 
through a generator relay to its own generator ac bus. The generator buses are 
used as load distribution buses for heavy 3-phase loads, including the ac buses 
and the emergency ac buses on the No. 1 and No. 2 systems. The ac buses are 
then used as load distribution buses for light 3-phase loads and single-phase 
loads. 

Two bus tie relays, one for each main generator channel, are configured so 
that they connect the two generator buses through an ac tie bus. Both relays 
are closed during paralleled operation. Flight crew controls permit the bus tie 
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relays to be individually opened manually, thus isolating the two distribution 
systems. 

Automatic circuits, when initiated by flight crew action, will parallel the 
two primary channels if system conditions are proper. If unparalleled operation 
is desired at startup, no action is required by the flight crew. If isolated 
operation is required, the bus tie relays can be manually switched open by the 
flight crew. 


Auxiliary Power 

Auxiliary power, derived from the generator driven directly by the onboard 
APU (located in the unpressurized portion of the aft fuselage), can be used to 
supplement the main system supply. The control arrangement allows connection 
of the APU generator output to a choice of one or both of the main distribution 
bus systems, or to the ac generator ground service bus only, without energizing 
any other ac bus. 


DC System Description 

The dc electrical power is derived from the ac system through four unregu- 
lated transformer/rectifier (T/R) units. Each unit is convection-cooled with 
a capacity of 75 amperes. The No. 1 and the No. 1A T/Rs receive power from 
the No. 1 generator bus. The No. 2 T/R receives power from the right ac 
emergency bus. The No. 2A T/R receives power from the ac generator ground 
service bus. Accordingly, during ground service operation, only the No. 2A 
T/R unit is energized. This provides power to the dc ground service bus and 
through a blocking diode to the battery bus. The four transformer/ rectifier 
units are normally operated isolated, but can pick up another dc load bus 
through the manually controlled tie relays and cross-tie circuit breaker. 
Redundant power is provided to the battery bus from the No. 1A T/R. Blocking 
diodes are installed for power source isolation and to prevent the battery from 
supplying power to dc buses. 

Electrical System Fault Tree 

A fault tree for the loss of electrical power is shown in the following 
figure. The initial configuration assumed is for dual generators without an 
APU. The calculated probability of electrical power loss is shown to be 
Q = 2.6 x 10-8. 
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